Re: [lamps] draft-ietf-lamps-cmp-updates and the ASN.1 modules

["Brockhaus, Hendrik" <[e-mail]>]

Russ

> Von: Russ Housley <[e-mail]>
> Gesendet: Samstag, 19. September 2020 16:06
> 
> Hendrik:
> 
> I have two comments on the ASN.1 modules.
> 
> 
> (1) The new module says:
> 
>        CertTemplate, PKIPublicationInfo, EncryptedKey, EncryptedValue,
>        CertId, CertReqMessages
>               FROM PKIXCRMF-2005 {iso(1) identified-organization(3)
>               dod(6) internet(1) security(5) mechanisms(5) pkix(7)
>               id-mod(0) id-mod-crmf2005(36)}
>        -- The import of EncryptedKey is added due to the updates made
>        -- in CMP Updates [thisRFC]
> 
> EncryptedValue is not longer used in the module.  It should probably be put in a
> comment.
> 

Right. I will remove the import of EncryptedValue and add a respective comment.

> 
> (2) This part is not changed, but I have a comment about it:
> 
>    Challenge ::= SEQUENCE {
>        owf                 AlgorithmIdentifier{DIGEST-ALGORITHM, {...}}
>                                OPTIONAL,
>        -- MUST be present in the first Challenge; MAY be omitted in
>        -- any subsequent Challenge in POPODecKeyChallContent (if
>        -- omitted, then the owf used in the immediately preceding
>        -- Challenge is to be used).
>        witness             OCTET STRING,
>        -- the result of applying the one-way function (owf) to a
>        -- randomly-generated INTEGER, A.  [Note that a different
>        -- INTEGER MUST be used for each Challenge.]
>        challenge           OCTET STRING
>        -- the encryption (under the public key for which the cert.
>        -- request is being made) of Rand, where Rand is specified as
>        --   Rand ::= SEQUENCE {
>        --      int      INTEGER,
>        --       - the randomly-generated INTEGER A (above)
>        --      sender   GeneralName
>        --       - the sender's name (as included in PKIHeader)
>        --   }
>    }
> 
> I've always thought it would help the implementer to make the Rand definition
> part of the ASN.1 module.
>

OK, I will move the declaration of Rand out of the comment.

- Hendrik