[lamps] [CMP Updates] Hash algorithm to us for calculating certHash

["Brockhaus, Hendrik" <[e-mail]>]

In OpenSSL recently a problem has been identified on how to derive a hash algorithm from signatureAlgorithm OID when using EdDSA, see https://github.com/openssl/openssl/issues/15477

In CMP this implicitly defined hash algorithms is used to calculate the certHash in a certConf messages. This would fail when using EdDSA.
The CertStatus structure including certHash is defined as follows:
     CertStatus ::= SEQUENCE {
        certHash    OCTET STRING,
        -- the hash of the certificate, using the same hash algorithm
        -- as is used to create and verify the certificate signature
        certReqId   INTEGER,
        -- to match this confirmation with the corresponding req/rep
        statusInfo  PKIStatusInfo OPTIONAL
     }
 
Therefore, the hash algorithms to be used for computing the certHash must be determined in some other way.
I currently see the following options:
(1) Specify usage of SHA-1 for calculating certHash, similar to the definition of the keyIdentifier in RFC 5280 Section 4.2.1.2.
  This is the cheapest solution, but we explicitly removed SHA-1 from CMP Algorithms, see mail thread "Re: CMP Algorithms I-D".
(2) Specify a hash algorithm on a per signature algorithm basis.
   This is also quite simple to implement, but costly to maintain for upcoming algorithms.
(3) Extend the ASN.1 syntax of CertStatus to allow to specify an optional hashAlg OID for those cases where the hash algorithm cannot be determined automatically.
   This is probably the cleanest solution, but involves a change to the ASN.1 syntax.
 
Does anyone sees other, better solutions?
What solution is preferred by the WG?

- Hendrik