Re: [lamps] ASN.1 Module in draft-ietf-lamps-cmp-updates

[Russ Housley <[e-mail]>]

> On Apr 28, 2021, at 12:27 PM, Brockhaus, Hendrik <[e-mail]> wrote:
> 
> 
>> Von: Russ Housley <[e-mail]>
>> 
>>> On Apr 26, 2021, at 2:52 AM, Brockhaus, Hendrik
>> <[e-mail]> wrote:
>>> 
>>> 
>>>> Von: Russ Housley <[e-mail]>
>>>> Gesendet: Freitag, 23. April 2021 20:06
>>>> 
>>>> Hendrik:
>>>> 
>>>> I do not understand how the AlgIdCtrl works.  Can you provide more
>>>> text in the document?  Is it about the subject public key?  Is it
>>>> about the signature algorithm to be used by the CA?
>>> 
>>> The purpose of AlgIdCtrl is to provide the algorithm specification the end
>> entity should use for generating its new key pair.
>>> We discussed the concept of the new controls in thread "dtaft-ietf-lamps-cmp-
>> updates and rsaKeyLen".
>>> 
>>> The current text is:
>>> 5.3.19.16.  Certificate Request Template
>>>  This MAY be used by the client to get a template containing
>>>  requirements for certificate request attributes and extensions and
>>>  optionally a specification for the key pair to generate for a future
>>>  certificate request operation.
>>> 
>>> I could change this to:
>>> 5.3.19.16.  Certificate Request Template
>>>  This MAY be used by the client to get a template containing
>>>  requirements for certificate request attributes and extensions.
>>>  The controls id-regCtrl-algId and id-regCtrl-rsaKeyLen MAY contain
>>>  details on the algorithms whose subject public key values the CA is
>>>  willing to certify.
>>> 
>>> Is this clearer?
>>> More details on the usage will be provided in the Lightweight CMP Profile
>> document.
>> 
>> Yes, but I would like to see another sentence about parameters.  With ECDSA,
>> for example, the parameters tell which curve the client should use.
>> 
> 
> I would propose to add the following text.
> 
> "The id-regCtrl-algId control MAY be used to identify a cryptographic algorithm, 
> see RFC 5820 Section 4.1.2.7, other than rsaEncryption. The algorithm field 
> SHALL identify the cryptographic algorithm. The contents of the optional 
> parameters field will vary according to the algorithm identified.
> 
> The id-regCtrl-rsaKeyLen control SHALL be used for algorithm rsaEncrytion and 
> SHALL contain the intended length of the RSA key."

This seems fine.  I might also say: For example, when the algorithm is set to id-ecPublicKey, the parameters identify the elliptic curve to be used [RFC5480].

Russ