Re: [Technical Errata Reported] RFC3029 (6444)

Le sam. 27 févr. 2021 à 08:45, Russ Housley <[email protected]> a écrit :

> I guess I should have held off on reporting this ASN.1 error.  Once I
> corrected it, I discovered two errors that I do not know how to fix.
>
> There is an implementation somewhere because Appendix F contains
> examples.  I do not know how the implementer got around these two problems.
>
>
> PROBLEM 1:
>
> CertEtcToken ::= CHOICE {
>      certificate                  [0] IMPLICIT Certificate ,
>      esscertid                    [1] ESSCertId ,
>      pkistatus                    [2] IMPLICIT PKIStatusInfo ,
>      assertion                    [3] ContentInfo ,
>      crl                          [4] IMPLICIT CertificateList,
>      ocspcertstatus               [5] IMPLICIT CertStatus,
>      oscpcertid                   [6] IMPLICIT CertId ,
>      oscpresponse                 [7] IMPLICIT OCSPResponse,
>      capabilities                 [8] SMIMECapabilities,
>      extension                    Extension{{ExtensionSet}}
> }
>
> CertEtcToken is a CHOICE with tags 0 through 8, but CertStatus CHOICE with
> tags 0 through 2.  You cannot nest a CHOICE in another CHOICE is the
> IMPLICIT tags overlap.
>
> The use of EXPLICIT tagging would have solved the problem, but the authors
> clearly preferred IMPLICIT tags.
>

Here, it's easy. The outermost IMPLICIT tag is transformed into an EXPLICIT
one by the ASN.1 compiler (it will probably emit a warning, though).

PROBLEM 2
>
> DigestInfo ::= SEQUENCE {
>     digestAlgorithm   DigestAlgorithmIdentifier,
>     digest            Digest
> }
>
> Data ::= CHOICE {
>       message           OCTET STRING ,
>       messageImprint    DigestInfo,
>       certs             SEQUENCE SIZE (1..MAX) OF
>                             TargetEtcChain
> }
>
> DigestInfo is a SEQUENCE, and certs is a SEQUENCE, so the two have the
> same tag.  A recipient cannot tell which one the sender intended.
>

For this one, there's clearly no solution. Tagging would have solved it
(any kind of tagging mode), but it's missing.


>
> > On Feb 26, 2021, at 3:54 PM, RFC Errata System <
> [email protected]> wrote:
> >
> > The following errata report has been submitted for RFC3029,
> > "Internet X.509 Public Key Infrastructure Data Validation and
> Certification Server Protocols".
> >
> > --------------------------------------
> > You may review the report below and at:
> > https://www.rfc-editor.org/errata/eid6444
> >
> > --------------------------------------
> > Type: Technical
> > Reported by: Russ Housley <[email protected]>
> >
> > Section: Appendix E
> >
> > Original Text
> > -------------
> >  GeneralName, PolicyInformation
> >  FROM PKIX1Implicit88 {iso(1) identified-organization(3)
> >  dod(6) internet(1) security(5) mechanisms(5) pkix(7)
> >  id-mod(0) id-pkix1-implicit-88(2)}
> >
> > Corrected Text
> > --------------
> >  GeneralName, GeneralNames, PolicyInformation
> >  FROM PKIX1Implicit88 {iso(1) identified-organization(3)
> >  dod(6) internet(1) security(5) mechanisms(5) pkix(7)
> >  id-mod(0) id-pkix1-implicit-88(2)}
> >
> > Notes
> > -----
> > The ASN.1 Module uses GeneralName and GeneralNames, but only one of them
> is IMPORTed.  The suggested fix IMPORTS both of GeneralName and
> GeneralNames.
> >
> > Instructions:
> > -------------
> > This erratum is currently posted as "Reported". If necessary, please
> > use "Reply All" to discuss whether it should be verified or
> > rejected. When a decision is reached, the verifying party
> > can log in to change the status and edit the report, if necessary.
> >
> > --------------------------------------
> > RFC3029 (draft-ietf-pkix-dcs-07)
> > --------------------------------------
> > Title               : Internet X.509 Public Key Infrastructure Data
> Validation and Certification Server Protocols
> > Publication Date    : February 2001
> > Author(s)           : C. Adams, P. Sylvester, M. Zolotarev, R. Zuccherato
> > Category            : EXPERIMENTAL
> > Source              : Public-Key Infrastructure (X.509)
> > Area                : Security
> > Stream              : IETF
> > Verifying Party     : IESG
>
> _______________________________________________
> pkix mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/pkix
>


-- 
Erwann.

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix