Subject: Re: [sidr] comments on draft-ietf-sidr-rfc6485bis

From: Sean Turner <[email-masked]>
Date: Wed, 2 Jul 2014 13:21:05 -0400

On May 20, 2014, at 13:49, Sandra Murphy <[email-masked]> wrote:

> ==============================
> 
> Then there's this new bit, which I noticed in the midst of checking
> what was needed for the certificate requests.
> 
> 
> In Section 2, the text says
> 
>      In a certification request, the OID appears in the PKCS #10
>      signatureAlgorithm field [RFC2986], or in the Certificate Request
>      Message Format (CRMF) POPOSigningKey signature field [RFC4211].
> 
> RFC4211 says that the POPOSigningKey is:
> 
>   POPOSigningKey ::= SEQUENCE {
>       poposkInput         [0] POPOSigningKeyInput OPTIONAL,
>       algorithmIdentifier     AlgorithmIdentifier,
>       signature               BIT STRING }
> 
> I'm pretty sure the text should say the OID goes in the POPOSigningKey
> algorithmIdentifier field, not the POPOSigningKey signature field.
> 
> [[While this looks clear to me, the comment could use some review by
> someone comfortable with ASN.1 overloaded and inconsistent field
> names.]]
> 
> That text is in the original RFC6485 and it has no relationship with the
> problem with the OID choice in CMS, the reason for this bis.
> 
> However, if true, this has implementation impact, so I think this
> should be considered at some point.
> 
> *IF* people agree that this is wrong, do the authors have any
> problem with changing the text in this bis?
> 
> FROM:
> 
>      Message Format (CRMF) POPOSigningKey signature field [RFC4211].
> 
> TO:
> 
>      Message Format (CRMF) POPOSigningKey algorithmIdentifier field 
>      [RFC4211].

This change makes sense to me because the name of the field is algorithmIdentifier not signature.

spt