Re: [Errata Held for Document Update] RFC7030 (4384)

-----Original Message-----
From: pkix <[email protected]> On Behalf Of Dan Harkins
Sent: Wednesday, August 19, 2020 2:00 PM
To: RFC Errata System <[email protected]>; [email protected]; [email protected]; [email protected]; [email protected]
Cc: [email protected]; [email protected]; [email protected]
Subject: Re: [pkix] [Errata Held for Document Update] RFC7030 (4384)


   Hi there,

On 8/19/20 12:58 PM, RFC Errata System wrote:
> The following errata report has been held for document update for 
> RFC7030, "Enrollment over Secure Transport".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid4384
>
> --------------------------------------
> Status: Held for Document Update
> Type: Technical
>
> Reported by: Pierce Leonberger <[email protected]>
> Date Reported: 2015-06-02
> Held by: Roman Danyliw (IESG)
>
> Section: 4.5.2
>
> Original Text
> -------------
> CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
>
> AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
>
> Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
>       type   ATTRIBUTE.&id({IOSet}),
>       values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
>
> Corrected Text
> --------------
> AttrOrOID ::= CHOICE {
>        oid OBJECT IDENTIFIER,
>        attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
> }
>
> Notes
> -----
> 1. The AttrOrOID CHOICE was started with a '(' versus a '{'.
>
> 2. Attribute{} is a parameterized type and you are missing the parameter reference within the AttrOrOID CHOICE for "attribute".

   "YouNeedToDefined...." needs to be a list of OIDs I believe. Since this is a request to someone on how to generate a CSR, the OIDs should be the ones that would be useful when giving such instruction. For instance:

[JLS] YouNeedToDefined needs to be an ObjectSet of Attributes.  An attribute is going to have both an OID and a Type in it.

   - "Generate a CSR with a public key from p384, add your serialNumber
      as an extReq, include challengePassword, and sign the whole thing
      with ECDSA and SHA384"

   - "Generate a CSR with RSA and a key that is 4096 bits, include
      challengePassword and sign the whole thing with RSA and SHA512"

So how about this:

   AttrOrOID ::= CHOICE {
        oid OBJECT IDENTIFER,
        attribute AttrSet
   }

   AttrSet ATTRIBUTE ::= { challengePassword, id-ecPublicKey, rsaEncryption,
                           extReq, ecdsa-with-SHA256, ecdsa-with-SHA384,
                           ecdsa-with-SHA512, SHA256, SHA384, SHA512, ... }

[JLS]
Items like challengePassword can be imported from RFC 2985.  However id-ecPublicKey is an OID so the ATTRIBUTE would need to be defined
att-ecPublicKey ::= ATTRIBUTE ::= { WITH SYNTAX ECParameters ID id-ecPublicKey }

Making an ASN.1 module would shake out which are needed to be defined as attributes.  I would use SHA256 in the oid choice myself.  Having an value set there would be useful so that people know which values go in which choices.

Jim



   Would this work? This is basically what I implemented in my EST reference design (plus some extra stuff like for extReq like macAddress, favoriteDrink, etc that might be considered part of "...").

   regards,

   Dan.

> 3. You need to define or reference the object set to be used in #2.
>
> Highly recommend you create an ASN.1 Module as part of this specification.  This will make it clear which specifications (and the versions there of) you are importing types from (i.e. Attribute{}) and the tagging that should be used (module level).  If you need to define a new object set for #3 then this new module would be the perfect home for it.
>
> --------------------------------------
> RFC7030 (draft-ietf-pkix-est-09)
> --------------------------------------
> Title               : Enrollment over Secure Transport
> Publication Date    : October 2013
> Author(s)           : M. Pritikin, Ed., P. Yee, Ed., D. Harkins, Ed.
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG
>
> _______________________________________________
> pkix mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/pkix

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix