Subject: [lamps] rfc7030-est clarifications and LAMPS charter

From: Michael Richardson <[email-masked]>
Date: Fri, 26 Jul 2019 16:47:33 -0400

secdispatch said that
  https://datatracker.ietf.org/doc/draft-richardson-lamps-rfc7030est-clarify/

belongs in LAMPS.  The word was that the charter did not include fixing
things.  The first paragragh includes:

   "Some updates have been proposed to the X.509 certificate documents
    produced by the PKIX Working Group and the electronic mail security
    documents produced by the S/MIME Working Group.

    The LAMPS (Limited Additional Mechanisms for PKIX and SMIME) Working
    Group is chartered to make updates where there is a known constituency
    interested in real deployment and there is at least one sufficiently
    well specified approach to the update so that the working group can
    sensibly evaluate whether to adopt a proposal."

but the last paragraph says:

    "In addition, the LAMPS WG may investigate other updates to documents
    produced by the PKIX and S/MIME WGs, but the LAMPS WG shall not adopt
    any of these potential work items without rechartering."

so I guess despite the weasel room at the beginning, it has to add
a #. point for RFC7030.  We have also discussed doing a light CMP profile.

Maybe a single point could say something about updates to Certificate
Enrollment protocols, include EST and CMP.

In the meantime, I need help evaluating the comments in
   https://www.rfc-editor.org/errata/eid4384

I simply don't have the ASN.1-fu to understand &Type.

}Section 4.5.2 says:
}CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
}
}AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
}
}Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
}     type   ATTRIBUTE.&id({IOSet}),
}     values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
]It should say:
}
}AttrOrOID ::= CHOICE {
}      oid OBJECT IDENTIFIER,
}      attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
}}

I presumed that while the ATTRIBUTE.&Type({IOSet}{@type}) was pretty much
not understandable to me, that it was legitimate.  I didn't know exactly
what the series of SET/SEQ it represented, but I just tweaked a bit
and matched against the examples shown.  I wound up with:
   Attribute = [ rfc822Name-OID, { [rfc822Name-value] } ]

[]-seq
{}-set

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Russ Housley <[email-masked]>
Date: Sat, 27 Jul 2019 07:51:24 -0400

The definition of ATTRIBUTE and Attribute  should be IMPORTed, not included here.

That leads to:

   AttrOrOID ::= CHOICE {
     oid        OBJECT IDENTIFIER,
     attribute  Attribute {{AttrSet}} }

   AttrSet ATTRIBUTE ::= { ... }

Russ

> On Jul 26, 2019, at 4:47 PM, Michael Richardson <[email-masked]> wrote:
> 
> Signed PGP part
> 
> secdispatch said that

---

From: Russ Housley <[email-masked]>
Date: Sun, 28 Jul 2019 12:49:33 -0400

Thinking about this some more, I think that the best way to resolve this errata is to provide an appendix with an ASN.1 module.  Here is my suggestion:

~~~

  -- There is no ASN.1 Module in RFC 7030.  This module has been created
  -- by combining the lines that are contained in the document body.
  -- A module identifier needs to be assigned for this to be used.

  PKIXEST-2019
      { iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-est-2019(TBD) }

  DEFINITIONS IMPLICIT TAGS ::=
  BEGIN

  -- EXPORTS ALL --

  IMPORTS

  Attribute
  FROM CryptographicMessageSyntax-2009
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
       smime(16) modules(0) id-mod-cms-2004-02(41) }

  ATTRIBUTE
  FROM PKIX-CommonTypes-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57) } ;

  -- CSR Attributes

  CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID

  AttrOrOID ::= CHOICE {
    oid        OBJECT IDENTIFIER,

  AttrSet ATTRIBUTE ::= { AttributesDefinedInRFC7030, ... }

  -- Asymmetric Decrypt Key Identifier Attribute

  AttributesDefinedInRFC7030 ATTRIBUTE ::= { aa-asymmDecryptKeyID, ... }

  aa-asymmDecryptKeyID ATTRIBUTE ::=
     { TYPE AsymmetricDecryptKeyIdentifier
       IDENTIFIED BY id-aa-asymmDecryptKeyID }

  id-aa-asymmDecryptKeyID OBJECT IDENTIFIER ::= { iso(1) member-body(2)
     us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) aa(2) 54 }

  AsymmetricDecryptKeyIdentifier ::= OCTET STRING

  END

~~~

A module identifier is needed.  I do not know if IANA has ever assigned an object identifier for an errata, but this seems like a much better way to fix this issue.

In addition, I made an assumption that the authors intended to use IMPLICIT TAGS.  That is the most common.  Having this is the specification will improve clarity and increase interoperability.

Russ

> On Jul 27, 2019, at 7:51 AM, Russ Housley <[email-masked]> wrote:
>

---

From: Russ Housley <[email-masked]>
Date: Sun, 28 Jul 2019 12:49:40 -0400

~~~

  PKIXEST-2019

  -- EXPORTS ALL --

  IMPORTS

  Attribute

  ATTRIBUTE

  -- CSR Attributes

  AttrOrOID ::= CHOICE {
    oid        OBJECT IDENTIFIER,

  END

~~~

Russ

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 31 Jul 2019 14:41:17 -0500

> Thinking about this some more, I think that the best way to resolve this errata is to provide an appendix with an ASN.1 module.  Here is my suggestion:

That feels somewhat heavyweight for an erratum.  What are the pros/cons of
errata vs. small updating RFC?

Thanks,

Ben

---

From: Michael Richardson <[email-masked]>
Date: Wed, 31 Jul 2019 16:48:07 -0400

Benjamin Kaduk <[email-masked]> wrote:
    >> Thinking about this some more, I think that the best way to resolve
    >> this errata is to provide an appendix with an ASN.1 module.  Here is
    >> my suggestion:

    > That feels somewhat heavyweight for an erratum.  What are the pros/cons
    > of errata vs. small updating RFC?

The intention is to have a small updating RFC.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [