IETF Logo Mail Archive

Re: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen

"Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com> Mon, 21 September 2020 16:02 UTC

Return-Path: <hendrik.brockhaus@siemens.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EDC93A09DA for <spasm@ietfa.amsl.com>; Mon, 21 Sep 2020 09:02:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Y6knlgy5Ttx for <spasm@ietfa.amsl.com>; Mon, 21 Sep 2020 09:02:54 -0700 (PDT)
Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130047.outbound.protection.outlook.com [40.107.13.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C088F3A09D5 for <spasm@ietf.org>; Mon, 21 Sep 2020 09:02:53 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=InFnqNfe7/4cGyPWWsukOXmr9SflfxCOJlYGw4GJoLDObBpHi1t0cwhtM9HZTeAEPHk7txUYp68XNO1FCF9Qu79pXxQ9GcUT+gANLvU7Y0j7hKYXMB4zUBjN6GFxZLx4DqP96Ab1VQ5XCLP4j8BC2ShaFkwd79pkBtO3RRosBjAWV4P0mLD15h1Rt2BujosGhIMn+gnCMxqYi1hOh78rFolct/Iz/SuZU8PJhYR4WHNGpHpshQQ8XBeHawAFQzphC8RPPS3RtKENIGZviJKIxlSWTg/KbRi4godeYn+wYc9jipkkpM7NpsiHbDtLzwi0FxzpTINNFo8sRsi6K1e8Vg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=naL/2WZnQqUBCxoSw/af2FZBKxRLPfB8bImE2S2DcDE=; b=BzW1iPT/iwI8fooNVawohbKqGjUImQiG5B+gnhW2wWFZ1dHitfvvGcdSaprPslIcVsaLmCuL3m08DI6pmO7+wQKJxuQ/JjSNUEx0bNaTPPOdzx5sUxLXYVbtOjsILy6n6vbu5bifMuThjQ28etubkimlM8SymtRr+MiT0kqGhG7i1hm1lgi3e9O7itNqhtxEiHavQREfuPGmk+GXx5OiW5Hb1H7fatzB3FW1Pk2/rx1ndaQxI2J9tnOUU2f/FiCzFaVmkvjvbLHijvA7VDyrt1a0YB1HYljQnst3zsMKzpsyF9cyKKo8DGQ3E9f5NiqMuCswlv5pjM+B9DTQAUtY+g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=naL/2WZnQqUBCxoSw/af2FZBKxRLPfB8bImE2S2DcDE=; b=jE1NYD/QuvPDtsL0hfjOoug1EQfvzFbDkFee6nWtRUIPY/qNiwymsgQkOx04GBDFNt83iAKBNHr9bOdoCTw+XbyGGIV8XG3uKjMUpoMh5QN0J2LW7P1q8CA5CZoWOTVkCzW6p17QA52vE1K6aCZgKlp7PDt8bTnoeewValE58i8=
Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:dd::17) by AM9PR10MB4037.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:1fe::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3391.23; Mon, 21 Sep 2020 16:02:49 +0000
Received: from AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::815c:e3e3:e2be:5eed]) by AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM ([fe80::815c:e3e3:e2be:5eed%6]) with mapi id 15.20.3391.024; Mon, 21 Sep 2020 16:02:49 +0000
From: "Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com>
To: Russ Housley <housley@vigilsec.com>
CC: "spasm@ietf.org" <spasm@ietf.org>, "david.von.oheimb@siemens.com" <david.von.oheimb@siemens.com>
Thread-Topic: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen
Thread-Index: AQHWi6YYHaZzdnX6XEOInEZKE7MbAalqzO3QgAByT4CAAvhy8IAAMHuAgATELwA=
Content-Class:
Date: Mon, 21 Sep 2020 16:02:49 +0000
Message-ID: <AM0PR10MB241834D3212142CE41D2F347FE3A0@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM>
References: <AM0PR10MB2418651EF480383C1FBAD448FE440@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM> <ECF4A046-3690-4B8A-9851-935CDACA89C2@vigilsec.com> <AM0PR10MB241896142536A43A77C92C05FE210@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM> <CFB4BA33-4F63-4825-A5D6-DA3D6A4F721E@vigilsec.com> <AM0PR10MB2418EE32B86335DEADEBB2C8FE3F0@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM> <A997BF81-E150-46F9-8D02-1E5125BB391F@vigilsec.com>
In-Reply-To: <A997BF81-E150-46F9-8D02-1E5125BB391F@vigilsec.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Enabled=true; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SetDate=2020-09-21T16:02:47Z; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Method=Standard; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_Name=restricted-default; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ActionId=9b2432ae-a827-4060-9e3a-794de9276bb7; MSIP_Label_a59b6cd5-d141-4a33-8bf1-0ca04484304f_ContentBits=0
document_confidentiality: Restricted
authentication-results: vigilsec.com; dkim=none (message not signed) header.d=none;vigilsec.com; dmarc=none action=none header.from=siemens.com;
x-originating-ip: [165.225.200.169]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 267d97a8-c181-43a0-5c1a-08d85e47ca0a
x-ms-traffictypediagnostic: AM9PR10MB4037:
x-ld-processed: 38ae3bcd-9579-4fd4-adda-b42e1495d55a,ExtAddr
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <AM9PR10MB40377A9A9ADCAE118016AB97FE3A0@AM9PR10MB4037.EURPRD10.PROD.OUTLOOK.COM>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: eSr2vS6R2O4pKr10HV/sCs/j+QFNJxQPbTST7DIte/AhC9NSSD8Qqcmj1qJKwBb819tnDgleulnkiNWWV4A5QQbT17dSQkMj0nntsE8tlIvOYpk7NJEUxwKJz8vJMK4ZmgpR3QWyVLqlu8jaCzad2PCTQtftBfM+1hbKOqtIkZWAOZHHb4BzsbWgZI9AdT/udj/BmwcOYGxRqFgXGWO5gkRnhyCdGtd4bjvQ6K9LmEFSzcUEClat0OJVqrIngxfAZGpMMrL5DGP8e0QF5QYZznqWbKoVui0+y07A0Lo5gWKrWPEKjc5BwmG5XcBzRjwf1dp9Xufz4HriE99ckd1LSw==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(396003)(346002)(39860400002)(366004)(376002)(136003)(316002)(2906002)(86362001)(33656002)(8676002)(8936002)(66946007)(76116006)(55236004)(6506007)(7696005)(5660300002)(52536014)(66556008)(9686003)(55016002)(4326008)(107886003)(66476007)(6916009)(71200400001)(54906003)(26005)(186003)(478600001)(66446008)(64756008)(66574015); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: yryTMHIszk2pQVNHHmCRrU1bHXx3nl9OlHh09S2vWwF3LQpFUchfjOOaA1jmvsTROm/zfHpV99azMQ+in+gSVtz6hP4uDdlMa9GiYqEB35P8RWTmyLjCye86cFT8uHJ9RCnWvN5hf9clsGoPAH0FElIZekfmdPCCrSvGEqL+77o7utCEL/rfV9+k5oe5WwO91WegCnXr23uSEqMNbVEcR4LQuUK9icGY+umsWgmKdF6PBo/sgemniKauVRgZZ9tFNRuRNGvVSWq1t6InYuP0wobTr92lU6SAVbd1MuIpjU2i0F4xCGoHRmlkXAmSpu6Gsx/IIR+M3JCJe7ABW63Yasxr4ohfm/+E+GFN+yu1TigoKh/ZYrdZsgJ4n/VxxopVcmvsT/Y6PfahLGiMEFMfAg/JCjM16WK7jcobKbHdMPp8ZbHfcCJhwiCh6Y3x6/5PheXZcqIozMbN8YOr+jWAWIX7zhAHs20jun83stXpxv+3LOTmATTT5i2jNXGN1Kq2YDl242vhfkf5oMT1pJ8Fx0e3MDocQ7ygikzhjuo0Z+aROzSZTz0Il6m0QjEf+1mdKOki/I3eT7jS7DgAl/NYT24RSzlGTJn2zdmRKoiQ/HmrxT1IxpABHo5N5R1TiuDhqWwQ4xzYR+yVxxnzRY1EBA==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 267d97a8-c181-43a0-5c1a-08d85e47ca0a
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Sep 2020 16:02:49.6701 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Y3egEPyLlKEiw3AsQnuJdQ7d/58np07GRbpIMGU7ptpVqDBIc5hr8JDGqsYBJzz8t22QMm2ZFg8TYNCwZToN2xJf8/Wi59TZG+uHicicFiQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR10MB4037
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/UukG4Iyj1kgy0NOwDgjF5hZcbmg>
Subject: Re: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Sep 2020 16:02:55 -0000

Russ:

> -----Ursprüngliche Nachricht-----
> Von: Spasm <spasm-bounces@ietf.org> Im Auftrag von Russ Housley
> 
> Hendrik:
> 
> > Right, a genRep can carry a sequence of InfoTypeAndValue and therefore a
> sequence of offered algorithms.
> > - In the case of 5.3.19.2 it could be a number of id-ecPublicKey structures.
> > - In the case of id-it-certReqTemplate (Lightweight CMP Profile, Section 4.4.4)
> we did not allow this case, but yes, we could change Lightweight CMP Profile
> Section 4.4.1 accordingly to offer it.
> > I can add a sentence to RFC 4210 Section 5.3.20 to explicitly state that several
> InfoTypeAndValues of the same type are allowed.
> > Did I get your suggestion right?
> 
> That seems like a fine way to move forward.
> 

I agree. 
But I just think I caused a little confusion above. I will try to sort this out:
- 5.3.19.2 and 5.3.19.3 already allow for a list of AlgorithmIdentifier. This should be fine except that one cannot specify RSA key lengths this way.
- If id-it-certReqTemplate uses the new Controls element (instead of rsaKeyLen) it also allows specifying several AlgorithmIdentifier elements and in addition also several RSA key lengths.
Therefore I feel like there is no need to add a note to 5.3.20 to point out that it is allowed to return several InfoTypeAndValue elements of same type but different values.
Do we have the same understanding?

- Hendrik

v2.23.0 | Report a Bug | By Email