[lamps] Re: WGLC for draft-ietf-lamps-csr-attestation-18

[Michael StJohns <[e-mail]>]

The silly mistakes are partially avoided by the default setting of 
&auxPresence to "absent".

Looking at RFC5912, I'm slightly confused as it's possible to do (for 
MESSAGE-DIGEST) a "PARAMS ARE required" (vice "PARAMS TYPE OCTET STRING 
ARE required") without specifying a type for &Params.  Which doesn't 
break anything exactly in the compile...  but .. it's weird not to have 
a default for the &Params type in that case.

That said, I think I'm fine with the change.  E.g. &AuxType OPTIONAL in 
the CLASS section  and no internal option brackets around [TYPE 
&AuxType] in the SYNTAX section.   I have no problem with requiring a 
complete specification without defaults for all of the various 
EVIDENCE-STATEMENT definitions.

Thanks - Mike

ps - I keep confusing "present" for "required" too....

On 5/5/2025 3:31 PM, Russ Housley wrote:
> I think it would be better to have the party that is defining an 
> evidence statement to ALWAYS specify the aux information if it exists. 
>  The DEFAULT OCTET STRING can lead to a silly mistake.  It seems 
> trivial to say:
>
> AUX TYPE OCTET STRING IS present
>
> to avoid the silly mistakes.
>
> Russ
>
>> On May 5, 2025, at 3:00 PM, Michael StJohns <[e-mail]> 
>> wrote:
>>
>> Aux(illary) works.
>>
>> I'd based the EVIDENCE-STATEMENT class on how some of the definitions 
>> were written in RFC5912, (see DIGEST-ALGORITHM for one) especially 
>> with respect to the &AuxType/aux field.   E.g. would changes
>>
>>     s/&AuxType OPTIONAL/&AuxType OCTET STRING OPTIONAL/
>>
>> and
>>
>>     s/[AUX TYPE &AuxType IS &auxPresent]/[AUX [TYPE &AuxType] IS
>>     &auxPresent]/
>>
>> to restore the original intent be useful?
>>
>> AFAICT, ParamOptions  for &auxPresent is just a way to carry 
>> implementation information, but can't actually be applied to the 
>> EvidenceStatement SEQUENCE definition.  But it makes me twitchy that 
>> &AuxType might not be set when instantiating the 
>> EvidenceStatement....  I'm actually surprised it compiled as is.
>>
>> Thanks - Mike
>>
>>
>> On 5/5/2025 1:55 PM, Russ Housley wrote:
>>> This compiles:
>>>
>>> FooBarModule
>>> DEFINITIONS IMPLICIT TAGS ::= BEGIN
>>>
>>> EVIDENCE-STATEMENT ::= CLASS {
>>>   &id          OBJECT IDENTIFIER UNIQUE,
>>>   &Type,
>>>   &auxPresent ParamOptions DEFAULT absent,
>>>   &AuxType    OPTIONAL
>>> } WITH SYNTAX {
>>>   &Type IDENTIFIED BY &id
>>>   [AUX TYPE &AuxType IS &auxPresent]
>>> }
>>>
>>> EvidenceStatementSet EVIDENCE-STATEMENT ::= {
>>>    mikesEvidenceStatement | otherEvidenceStatement | 
>>> tcgDiceAttestTPMCertify,
>>>    ... }
>>>
>>> EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement
>>>
>>> EvidenceStatement ::= SEQUENCE {
>>>    type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}),
>>>    stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}),
>>>    aux EVIDENCE-STATEMENT.&AuxType({EvidenceStatementSet}{@type}) 
>>> OPTIONAL }
>>>
>>> ParamOptions ::= ENUMERATED {
>>>    required,         -- Parameters MUST be encoded in structure
>>>    preferredPresent, -- Parameters SHOULD be encoded in structure
>>>    preferredAbsent,  -- Parameters SHOULD NOT be encoded in structure
>>>    absent,           -- Parameters MUST NOT be encoded in structure
>>>    inheritable,      -- Parameters are inherited if not present
>>>    optional,         -- Parameters MAY be encoded in the structure
>>>    ... }
>>>
>>> mikesEvidenceStatement EVIDENCE-STATEMENT ::= {
>>>    MikesASN1Structure IDENTIFIED BY id-mikes-statement
>>>    AUX TYPE MikesHint IS required }
>>>
>>> id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 }
>>>
>>> MikesASN1Structure ::= OCTET STRING
>>>
>>> MikesHint ::= IA5String
>>>
>>> otherEvidenceStatement EVIDENCE-STATEMENT ::= {
>>>    PrintableString IDENTIFIED BY id-other-statement }
>>>
>>> id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 }
>>>
>>> tcgDiceAttestTPMCertify EVIDENCE-STATEMENT ::= {
>>>    Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify
>>>    AUX TYPE Hint IS preferredPresent }
>>> tcg OBJECT IDENTIFIER ::= { 2 23 133 }
>>>
>>> tcg-kp-AIKCertificate OBJECT IDENTIFIER ::= { tcg 8 3 }
>>>
>>> tcg-attest OBJECT IDENTIFIER ::= { tcg 20 }
>>>
>>> tcg-attest-tpm-certify OBJECT IDENTIFIER ::= { tcg-attest 1 }
>>>
>>> Tcg-attest-tpm-certify ::= SEQUENCE {
>>>    tpmSAttest   OCTET STRING,
>>>    signature    OCTET STRING,
>>>    tpmTPublic   OCTET STRING OPTIONAL }
>>>
>>> Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:"))
>>>
>>> END
>>>
>>>
>>>
>>> Note: there are several problems in the TCG example that are 
>>> correctesd in the above, including these typos:
>>>
>>> s/id-tcg/tcg/
>>>
>>> s/Tcg-csr-tpm-certify/Tcg-attest-tpm-certify/
>>>
>>> Russ
>>>