Re: [lamps] rfc7030-est clarifications and LAMPS charter

[Russ Housley <[e-mail]>]

Thinking about this some more, I think that the best way to resolve this errata is to provide an appendix with an ASN.1 module.  Here is my suggestion:

~~~

  -- There is no ASN.1 Module in RFC 7030.  This module has been created
  -- by combining the lines that are contained in the document body.
  -- A module identifier needs to be assigned for this to be used.

  PKIXEST-2019
      { iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-est-2019(TBD) }

  DEFINITIONS IMPLICIT TAGS ::=
  BEGIN

  -- EXPORTS ALL --

  IMPORTS

  Attribute
  FROM CryptographicMessageSyntax-2009
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
       smime(16) modules(0) id-mod-cms-2004-02(41) }

  ATTRIBUTE
  FROM PKIX-CommonTypes-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57) } ;


  -- CSR Attributes

  CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID

  AttrOrOID ::= CHOICE {
    oid        OBJECT IDENTIFIER,
    attribute  Attribute {{AttrSet}} }

  AttrSet ATTRIBUTE ::= { AttributesDefinedInRFC7030, ... }


  -- Asymmetric Decrypt Key Identifier Attribute

  AttributesDefinedInRFC7030 ATTRIBUTE ::= { aa-asymmDecryptKeyID, ... }

  aa-asymmDecryptKeyID ATTRIBUTE ::=
     { TYPE AsymmetricDecryptKeyIdentifier
       IDENTIFIED BY id-aa-asymmDecryptKeyID }

  id-aa-asymmDecryptKeyID OBJECT IDENTIFIER ::= { iso(1) member-body(2)
     us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) aa(2) 54 }

  AsymmetricDecryptKeyIdentifier ::= OCTET STRING

  END


~~~

A module identifier is needed.  I do not know if IANA has ever assigned an object identifier for an errata, but this seems like a much better way to fix this issue.

In addition, I made an assumption that the authors intended to use IMPLICIT TAGS.  That is the most common.  Having this is the specification will improve clarity and increase interoperability.

Russ


> On Jul 27, 2019, at 7:51 AM, Russ Housley <[e-mail]> wrote:
> 
> The definition of ATTRIBUTE and Attribute  should be IMPORTed, not included here.
> 
> That leads to:
> 
>  AttrOrOID ::= CHOICE {
>    oid        OBJECT IDENTIFIER,
>    attribute  Attribute {{AttrSet}} }
> 
>  AttrSet ATTRIBUTE ::= { ... }
> 
> Russ
> 
>> On Jul 26, 2019, at 4:47 PM, Michael Richardson <[e-mail]> wrote:
>> 
>> Signed PGP part
>> 
>> secdispatch said that
>> https://datatracker.ietf.org/doc/draft-richardson-lamps-rfc7030est-clarify/
>> 
>> belongs in LAMPS.  The word was that the charter did not include fixing
>> things.  The first paragragh includes:
>> 
>> "Some updates have been proposed to the X.509 certificate documents
>>  produced by the PKIX Working Group and the electronic mail security
>>  documents produced by the S/MIME Working Group.
>> 
>>  The LAMPS (Limited Additional Mechanisms for PKIX and SMIME) Working
>>  Group is chartered to make updates where there is a known constituency
>>  interested in real deployment and there is at least one sufficiently
>>  well specified approach to the update so that the working group can
>>  sensibly evaluate whether to adopt a proposal."
>> 
>> but the last paragraph says:
>> 
>>  "In addition, the LAMPS WG may investigate other updates to documents
>>  produced by the PKIX and S/MIME WGs, but the LAMPS WG shall not adopt
>>  any of these potential work items without rechartering."
>> 
>> so I guess despite the weasel room at the beginning, it has to add
>> a #. point for RFC7030.  We have also discussed doing a light CMP profile.
>> 
>> Maybe a single point could say something about updates to Certificate
>> Enrollment protocols, include EST and CMP.
>> 
>> In the meantime, I need help evaluating the comments in
>> https://www.rfc-editor.org/errata/eid4384
>> 
>> I simply don't have the ASN.1-fu to understand &Type.
>> 
>> }Section 4.5.2 says:
>> }CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
>> }
>> }AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
>> }
>> }Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
>> }     type   ATTRIBUTE.&id({IOSet}),
>> }     values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
>> ]It should say:
>> }
>> }AttrOrOID ::= CHOICE {
>> }      oid OBJECT IDENTIFIER,
>> }      attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
>> }}
>> 
>> I presumed that while the ATTRIBUTE.&Type({IOSet}{@type}) was pretty much
>> not understandable to me, that it was legitimate.  I didn't know exactly
>> what the series of SET/SEQ it represented, but I just tweaked a bit
>> and matched against the examples shown.  I wound up with:
>> Attribute = [ rfc822Name-OID, { [rfc822Name-value] } ]
>> 
>> []-seq
>> {}-set
>> 
>> --
>> ]               Never tell me the odds!                 | ipv6 mesh networks [
>> ]   Michael Richardson, Sandelman Software Works        | network architect  [
>> ]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [
>> 
>> 
>> 
>> 
>> 
>> --
>> Michael Richardson <[e-mail]>, Sandelman Software Works
>> -= IPv6 IoT consulting =-
>> 
>> 
>> 
>> 
>> 
>