[lamps] Re: WGLC for draft-ietf-lamps-csr-attestation-18

[Michael StJohns <[e-mail]>]

Aux(illary) works.

I'd based the EVIDENCE-STATEMENT class on how some of the definitions 
were written in RFC5912, (see DIGEST-ALGORITHM for one) especially with 
respect to the &AuxType/aux field.   E.g. would changes

    s/&AuxType OPTIONAL/&AuxType OCTET STRING OPTIONAL/

and

    s/[AUX TYPE &AuxType IS &auxPresent]/[AUX [TYPE &AuxType] IS
    &auxPresent]/

to restore the original intent be useful?

AFAICT, ParamOptions  for &auxPresent is just a way to carry 
implementation information, but can't actually be applied to the 
EvidenceStatement SEQUENCE definition.  But it makes me twitchy that 
&AuxType might not be set when instantiating the EvidenceStatement....  
I'm actually surprised it compiled as is.

Thanks - Mike


On 5/5/2025 1:55 PM, Russ Housley wrote:
> This compiles:
>
> FooBarModule
> DEFINITIONS IMPLICIT TAGS ::= BEGIN
>
> EVIDENCE-STATEMENT ::= CLASS {
>   &id          OBJECT IDENTIFIER UNIQUE,
>   &Type,
>   &auxPresent ParamOptions DEFAULT absent,
>   &AuxType    OPTIONAL
> } WITH SYNTAX {
>   &Type IDENTIFIED BY &id
>   [AUX TYPE &AuxType IS &auxPresent]
> }
>
> EvidenceStatementSet EVIDENCE-STATEMENT ::= {
>    mikesEvidenceStatement | otherEvidenceStatement | 
> tcgDiceAttestTPMCertify,
>    ... }
>
> EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement
>
> EvidenceStatement ::= SEQUENCE {
>    type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}),
>    stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}),
>    aux EVIDENCE-STATEMENT.&AuxType({EvidenceStatementSet}{@type}) 
> OPTIONAL }
>
> ParamOptions ::= ENUMERATED {
>    required,         -- Parameters MUST be encoded in structure
>    preferredPresent, -- Parameters SHOULD be encoded in structure
>    preferredAbsent,  -- Parameters SHOULD NOT be encoded in structure
>    absent,           -- Parameters MUST NOT be encoded in structure
>    inheritable,      -- Parameters are inherited if not present
>    optional,         -- Parameters MAY be encoded in the structure
>    ... }
>
> mikesEvidenceStatement EVIDENCE-STATEMENT ::= {
>    MikesASN1Structure IDENTIFIED BY id-mikes-statement
>    AUX TYPE MikesHint IS required }
>
> id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 }
>
> MikesASN1Structure ::= OCTET STRING
>
> MikesHint ::= IA5String
>
> otherEvidenceStatement EVIDENCE-STATEMENT ::= {
>    PrintableString IDENTIFIED BY id-other-statement }
>
> id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 }
>
> tcgDiceAttestTPMCertify EVIDENCE-STATEMENT ::= {
>    Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify
>    AUX TYPE Hint IS preferredPresent }
> tcg OBJECT IDENTIFIER ::= { 2 23 133 }
>
> tcg-kp-AIKCertificate OBJECT IDENTIFIER ::= { tcg 8 3 }
>
> tcg-attest OBJECT IDENTIFIER ::= { tcg 20 }
>
> tcg-attest-tpm-certify OBJECT IDENTIFIER ::= { tcg-attest 1 }
>
> Tcg-attest-tpm-certify ::= SEQUENCE {
>    tpmSAttest   OCTET STRING,
>    signature    OCTET STRING,
>    tpmTPublic   OCTET STRING OPTIONAL }
>
> Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:"))
>
> END
>
>
>
> Note: there are several problems in the TCG example that are 
> correctesd in the above, including these typos:
>
> s/id-tcg/tcg/
>
> s/Tcg-csr-tpm-certify/Tcg-attest-tpm-certify/
>
> Russ
>
>
>> On May 4, 2025, at 10:22 PM, Michael StJohns <[e-mail]> 
>> wrote:
>>
>> Hi Russ - to close out the ASN1 specific comments  -
>>
>> Referencing X.680, Appendix A, I get this for Hint: (these both 
>> compile at the asn1.io playground).
>>
>>     -- At least 2 and not more than 10 DNS labels including the TLD.
>>     The last label has at least 2 letters. Optional port specification.
>>     -- Basically a URI with just the DNS name and an optional port
>>     and without everything else.
>>     Hint ::= IA5String (PATTERN
>>     "(([a-z]|[A-Z])\w#(,63)\.)#(1,9)([a-z]|[A-Z])\w#(1,63)(:\d#(1,5))?")
>>
>>     Alternately (just constraining the included characters):
>>
>>     Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:"))
>>
>> Assuming the change to [A]ncillary from [H]int  and not making Hint 
>> the default- this results in the following changes to the 
>> EVIDENCE-STATEMENT definitions in appendix A:
>>
>> EvidenceStatementSet EVIDENCE-STATEMENT ::= {
>>       --- TPM 2.0
>>       { Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify
>>                                ANCILLARY TYPE Hint IS preferredPresent },
>>       ...,
>>
>>       --- PSA
>>       { OCTET STRING IDENTIFIED BY { 1 3 6 1 5 5 7 1 99 }
>>                      ANCILLARY TYPE Hint IS preferredPresent }
>>     }
>>
>>
>> and in Appendix B:
>>
>> tcgDiceCmwEvidenceStatement EVIDENCE-STATEMENT ::= {
>> DiceConceptualMessageWrapper IDENTIFIED BY 
>> tcg-dice-conceptual-message-wrapper
>> ANCILLARY TYPE Hint IS preferredPresent
>> }
>>
>>
>> tcgDiceTcbInfoEvidenceStatementES EVIDENCE-STATEMENT ::=  {
>>                    DiceTcbInfo IDENTIFIED BY tcg-dice-TcbInfo
>>                                ANCILLARY TYPE Hint is preferredPresent
>>                   }
>>
>> -- or "required" depending...
>>
>> Another nit - 1.3.6.2.5.5.7.1 certificate extensions registry... 
>> probably not the right place for EVIDENCE-STATEMENT registrations - 
>> even for an example?
>>
>> Later, Mike
>>
>> On 5/4/2025 7:46 PM, StJohns, Michael wrote:
>>> With the exception of the item you note (a default type for the 
>>> secondary- “hint” field and its presence indication), that’s 
>>> correct.  I used “ancillary” where you have “hint” because the 
>>> general case is just additional data specific to the evidence type.
>>>
>>> For reference this uses the object id to identify the type (and 
>>> possibly presence) of both the main field and the ancillary.
>>>
>>> Given the text describing the IA5String hint field, I’d define the 
>>> Hint type using either the FROM or PATTERN constraint - ideally the 
>>> latter.  E.G.
>>>
>>> — where you have MikesHint use this instead
>>> Hint ::= IA5String (FROM 
>>> (“0..9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.:”))
>>>
>>> Or
>>>
>>> Hint ::= IA5String (PATTERN “<tbd>”)
>>>
>>> Mike
>>>
>>>
>>>
>>> On Sun, May 4, 2025 at 18:10 Russ Housley <[e-mail]> wrote:
>>>
>>>
>>>     Mike:
>>>
>>>     I could not get your ASN.1 to compile.  Please look at this. 
>>>     Does it do what you are suggesting?
>>>
>>>     I realize that I removed the DEFAULT type of the Hint being an
>>>     OCTET STRING, but I think the rest is captured.
>>>
>>>     If this captures your idea, then the authors can respond about
>>>     whether they like it.
>>>
>>>     Russ
>>>
>>>     = = = = = = =
>>>
>>>     FooBarModule
>>>     DEFINITIONS IMPLICIT TAGS ::= BEGIN
>>>
>>>     EVIDENCE-STATEMENT ::= CLASS {
>>>       &id          OBJECT IDENTIFIER UNIQUE,
>>>       &Type,
>>>       &hintPresent ParamOptions DEFAULT absent,
>>>       &HintType    OPTIONAL
>>>     } WITH SYNTAX {
>>>       &Type IDENTIFIED BY &id
>>>       [HINT TYPE &HintType ARE &hintPresent]
>>>     }
>>>
>>>     EvidenceStatementSet EVIDENCE-STATEMENT ::= {
>>>        mikesEvidenceStatement | otherEvidenceStatement, ... }
>>>
>>>     EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement
>>>
>>>     EvidenceStatement ::= SEQUENCE {
>>>        type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}),
>>>        stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}),
>>>        hint
>>>     EVIDENCE-STATEMENT.&HintType({EvidenceStatementSet}{@type})
>>>     OPTIONAL }
>>>
>>>     ParamOptions ::= ENUMERATED {
>>>        required,         -- Parameters MUST be encoded in structure
>>>        preferredPresent, -- Parameters SHOULD be encoded in structure
>>>        preferredAbsent,  -- Parameters SHOULD NOT be encoded in
>>>     structure
>>>        absent,           -- Parameters MUST NOT be encoded in structure
>>>        inheritable,      -- Parameters are inherited if not present
>>>        optional,         -- Parameters MAY be encoded in the structure
>>>        ... }
>>>
>>>     mikesEvidenceStatement EVIDENCE-STATEMENT ::= {
>>>        MikesASN1Structure IDENTIFIED BY id-mikes-statement
>>>        HINT TYPE MikesHint ARE required }
>>>
>>>     id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 }
>>>
>>>     MikesASN1Structure ::= OCTET STRING
>>>
>>>     MikesHint ::= IA5String
>>>
>>>     otherEvidenceStatement EVIDENCE-STATEMENT ::= {
>>>        OtherStructure IDENTIFIED BY id-other-statement }
>>>
>>>     id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 }
>>>
>>>     OtherStructure ::= PrintableString
>>>
>>>     END
>>>
>>
>