Subject: [lamps] rfc7030-est clarifications of ASN.1

From: Michael Richardson <[email-masked]>
Date: Wed, 31 Jul 2019 16:47:33 -0400

{starting a new thread not related to charter}

Russ Housley <[email-masked]> wrote:
    >   IMPORTS

    >   Attribute FROM CryptographicMessageSyntax-2009 { iso(1)
    > member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
    > modules(0) id-mod-cms-2004-02(41) }

    >   ATTRIBUTE FROM PKIX-CommonTypes-2009 { iso(1)
    > identified-organization(3) dod(6) internet(1) security(5) mechanisms(5)
    > pkix(7) id-mod(0) id-mod-pkixCommon-02(57) } ;

    >   -- CSR Attributes

    >   CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID

    >   AttrOrOID ::= CHOICE { oid OBJECT IDENTIFIER, attribute Attribute
    > {{AttrSet}} }

    >   AttrSet ATTRIBUTE ::= { AttributesDefinedInRFC7030, ... }

I'm not sure I understand what the ... here means.

I think this is not real ASN.1 syntax, but rather an indication for me to
insert more stuff?  Or is this something real that I don't understand.

    >   -- Asymmetric Decrypt Key Identifier Attribute

    >   AttributesDefinedInRFC7030 ATTRIBUTE ::= { aa-asymmDecryptKeyID,
    > ... }

I feel that the AttrSet is not correctly understood.
It's supposed to be any attribute that could occur in a (Subject) DN,
or a SubjectAltName.  

    > A module identifier is needed.  I do not know if IANA has ever assigned
    > an object identifier for an errata, but this seems like a much better
    > way to fix this issue.

AFAIK, it did not.

    > In addition, I made an assumption that the authors intended to use
    > IMPLICIT TAGS.  That is the most common.  Having this is the
    > specification will improve clarity and increase interoperability.

I think so, yes.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Russ Housley <[email-masked]>
Date: Wed, 31 Jul 2019 20:29:41 -0400

> I'm not sure I understand what the ... here means.

It means that future specification can add to the set.

> insert more stuff?  Or is this something real that I don't understand.

No, this is real ASN.1 syntax.

> It's supposed to be any attribute that could occur in a (Subject) DN,

That is the whole point for including the ...

If we knew the whole set right now, we could IMPORT the others to define it.

Russ

---

From: Michael Richardson <[email-masked]>
Date: Wed, 31 Jul 2019 21:25:01 -0400

Russ Housley <[email-masked]> wrote:
    >> I think this is not real ASN.1 syntax, but rather an indication for me
    >> to insert more stuff?  Or is this something real that I don't
    >> understand.

    > No, this is real ASN.1 syntax.

okay.
It's something I once tried to learn, back in 1995, and I got as far as the
trivial stuff, but that was all.

I will incorporate your module into the clarifications document.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-