Re: [TLS] CertficateRequest extension encoding

Andrei Popov <Andrei.Popov@microsoft.com> Wed, 26 April 2017 19:03 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 111151286B1 for <tls@ietfa.amsl.com>; Wed, 26 Apr 2017 12:03:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.022
X-Spam-Level:
X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZksI8Ca6yuDl for <tls@ietfa.amsl.com>; Wed, 26 Apr 2017 12:03:37 -0700 (PDT)
Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0134.outbound.protection.outlook.com [104.47.34.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF82C128B8D for <tls@ietf.org>; Wed, 26 Apr 2017 12:03:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=3s+2gSHbY3S/dvkyZza0cyhn0SOfF808gV7IJ9+ra+c=; b=XB02bfbAWs0NEmFkelxOWVKQZEN6fHxgvbt207uDYsNvtzmQG5KSTSBuTXr7Hk3xQ2vwALqf/9STF8G+MOzp88gPZ9LF0PSpKNqiNC6VhlWmRBRxGIS70BiSyq1lkTStOZ/L+C/V4ukQMtBZcupECSkWEUjRJdZMaRRElSnk4vs=
Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0089.namprd21.prod.outlook.com (10.161.141.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1061.4; Wed, 26 Apr 2017 19:03:35 +0000
Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.1061.008; Wed, 26 Apr 2017 19:03:35 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: "ilariliusvaara@welho.com" <ilariliusvaara@welho.com>
CC: David Benjamin <davidben@chromium.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] CertficateRequest extension encoding
Thread-Index: AQHSBpsXZcombga0NEGFs2xYmfILPaBpmgGAgAAAfICAAc2xcIFt6MOAgAAgapA=
Date: Wed, 26 Apr 2017 19:03:34 +0000
Message-ID: <DM2PR21MB009139648D8730727179E2D98C110@DM2PR21MB0091.namprd21.prod.outlook.com>
References: <20160904105637.sjl4wmr2hc2mito6@LK-Perkele-V2.elisa-laajakaista.fi> <CAF8qwaApcZBC0K8m27CtYbUd3zb5HvVQbDxpN0kkY0c=Pj4Rcw@mail.gmail.com> <CAF8qwaDVGrnzeLQD1ika0=VZbD8gJpigcRv_qgiAYdHV_iS2jA@mail.gmail.com> <CY1PR0301MB08421CDD92828E5809E40E8C8CE60@CY1PR0301MB0842.namprd03.prod.outlook.com> <20170426170351.GA30439@LK-Perkele-V2.elisa-laajakaista.fi>
In-Reply-To: <20170426170351.GA30439@LK-Perkele-V2.elisa-laajakaista.fi>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: welho.com; dkim=none (message not signed) header.d=none;welho.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [2001:4898:80e8:e::4ca]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM2PR21MB0089; 7:Xa/4vCyLNxumE5vmCrNkryVPminCt51sVCGsJ5+v2ZBb6XV0SZWwuHAB6GnRh7++4E05bc4gJj6Of2jV9p5DujUzl2Z0rMh3Ijt3snt1gN1IJeM/Od1F7fGrsOeCEoo4nZ5rZcjv1OsbG+q5b08Y1U8WvUxEDFrgCHcdkD9cz3BRxadnvc+nrrxchXp8J7KDD8HJHZTTuCxVzFaltoJyx59U+Z/oMyiXKnkQV9XL12e8qhG3h0hHkFVncXBKOw6nX7yiA0oSoTDS7cFNpgcNbS1935tpxjMP1kvGW1x7MAxfXHMK0rtzg8YiZ9cXG4zk9MVOqvm1Kr0eyXZRSvhkUfqIVDuYdfQ1W4BSWu0fQmQ=
x-ms-office365-filtering-correlation-id: 9857b1ce-8f2c-4d82-5a8e-08d48cd6f0aa
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:DM2PR21MB0089;
x-microsoft-antispam-prvs: <DM2PR21MB0089EC3F7F0030052BFD5D318C110@DM2PR21MB0089.namprd21.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(6055026)(61426038)(61427038)(6041248)(20161123558100)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123555025)(20161123560025)(6072148); SRVR:DM2PR21MB0089; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0089;
x-forefront-prvs: 0289B6431E
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39400400002)(39410400002)(39860400002)(39450400003)(39840400002)(39850400002)(57704003)(13464003)(24454002)(377454003)(3660700001)(53936002)(54356999)(76176999)(50986999)(74316002)(10090500001)(122556002)(9686003)(2900100001)(6916009)(2950100002)(189998001)(4326008)(54906002)(10290500003)(99286003)(77096006)(8990500004)(2501003)(2906002)(6246003)(33656002)(3280700002)(6436002)(2351001)(55016002)(229853002)(102836003)(6116002)(6506006)(8936002)(7696004)(8676002)(1730700003)(81166006)(53546009)(25786009)(5005710100001)(7736002)(305945005)(93886004)(86362001)(110136004)(38730400002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0089; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Apr 2017 19:03:34.9874 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0089
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/fZ1eOUS6ZZxjEsQUeQkRP4dxyew>
Subject: Re: [TLS] CertficateRequest extension encoding
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Apr 2017 19:03:39 -0000

Hi Ilari,

I don't have this implemented yet, but yes, tag/length should be included. Same as in the actual cert.

Cheers,

Andrei

-----Original Message-----
From: ilariliusvaara@welho.com [mailto:ilariliusvaara@welho.com] 
Sent: Wednesday, April 26, 2017 10:04 AM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: David Benjamin <davidben@chromium.org>; tls@ietf.org
Subject: Re: [TLS] CertficateRequest extension encoding

On Mon, Sep 05, 2016 at 09:46:51PM +0000, Andrei Popov wrote:
> 
> Do we need to make it this flexible? The idea was to avoid adding 
> complexity to the certificate filtering code in the TLS stack, and 
> instead filter by OIDs in the PKI library. PKI libraries already 
> inspect and match OID values, so this should be a relatively small 
> change for them.

Haven't found an answer to this yet...


How are the OIDs encoded exactly? Does the value of 'certificate_extension_oid' include redundant OBJECT IDENTIFIER tag and length, or not?

That is, is id-pe-nsa [1.3.6.1.5.5.7.1.23] (just to pick an example) in certificate_extension_oid field encoded as:

1) 2B 06 01 05 05 07 01 17  (no tag/length)
2) 06 08 2B 06 01 05 05 07 01 17  (tag/length included).

?


-Ilari