Subject: [lamps] ASN.1 module for 7030est clarify - was [pkix] [Errata Held for Document Update] RFC7030 (4384)

From: Jim Schaad <[email-masked]>
Date: Thu, 20 Aug 2020 11:07:36 -0700

So as suggested by Russ, I when and looked at it

I think that the module needs to have some modifications.

1)  If you really mean to have the oid option for AttrOrOid then you should
have

AttrOrOID ::= CHOICE {
	oid	OBJECT IDENTIFIER (OidValueSet),
	attribute Attribute {{AttrSet}} }

OidValueSet OBJECT IDENTIFER ::= { ...}
AttrSet ATTRIBUTE  ::= {...}

2) I would really suggest that if there are some known values, especially if
there are not attributes defined already, that these attributes be defined
and added to the value and object sets.  This becomes interesting since
challengePassword is defined with an attribute in PKSC#9 but appears to be
used only as a bare OID in this specification.  That is not how would have
expected things to work, I would have thought it was a challengePassword
with an empty type value.

Jim

-----Original Message-----
From: pkix <[email-masked]> On Behalf Of Russ Housley
Sent: Thursday, August 20, 2020 10:45 AM
To: Dan Harkins <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; [email-masked]; IESG
<[email-masked]>; IETF PKIX <[email-masked]>; RFC Editor
<[email-masked]>
Subject: Re: [pkix] [Errata Held for Document Update] RFC7030 (4384)

> Making an ASN.1 module would shake out which are needed to be defined as
attributes.  I would use SHA256 in the oid choice myself.  Having an value
set there would be useful so that people know which values go in which
choices.

Please see the ASN.1 module in draft-ietf-lamps-rfc7030est-clarify.

Russ

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Michael Richardson <[email-masked]>
Date: Fri, 21 Aug 2020 13:21:49 -0400

> So as suggested by Russ, I when and looked at it

oops, it is in the RFC editor queue at this point.

    > AttrSet ATTRIBUTE  ::= {...}

Your change involves the (OidValueSet).
We don't know what the ValueSet will be, so I'm not sure I understand what
the difference would be.   OidValueSet is whatever has been (or will be) defined for CSRs.

    > and added to the value and object sets.

I can see how this would help implementors, telling them what to expect.
Is that your idea?

    > This becomes interesting since

Yes, I think that's right.
Does the WG need to reset on this document?
Is this AUTH48'able?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Russ Housley <[email-masked]>
Date: Fri, 21 Aug 2020 13:53:48 -0400

Michael:

There is noting broken with the ASN.1 module in the current I-D.  The proposal just make it "tighter".

Russ

> On Aug 21, 2020, at 1:21 PM, Michael Richardson <[email-masked]> wrote:
>