Subject: [lamps] draft-ietf-lamps-cmp-updates

From: Russ Housley <[email-masked]>
Date: Sun, 26 Jul 2020 15:33:39 -0400

IANA has made the assignment for id-kp-cmKGA.

I was looking at Appendix A in the draft, and it is not completely clear to me what the revised ASN.1 module looks like:

First, the source of some imports is updated.  No big deal.

Second, in CertifiedKeyPair and CertOrEncCert, the EncryptedValue os replaced with EncryptedKey.

Third, id-it-revPassphrase (which is in a comment) is associated with EncryptedKey instead of EncryptedValue.

Fourth, id-kp-cmKGA is added to the list of EKU values, but these do not appear in the previous module anywhere.  Where do they belong?

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 27 Jul 2020 16:22:48 +0000

Russ

Thanks for having a coser look at the ASN.1 module.
Actually I am a little uncertain how to properly specify things. :-(

> Von: Russ Housley <[email-masked]>
> 

That is great. I will add the OID in the next release of the draft.

> 
> I was looking at Appendix A in the draft, and it is not completely clear to me
> what the revised ASN.1 module looks like:
> 

Finally, I do not fully understand this specification, too. 
My goal is to update OID {id-it 12}  as specified in section 5.3.19.9 and the only lines in the ASN.1 module on this OID is in comments?

> 
> Fourth, id-kp-cmKGA is added to the list of EKU values, but these do not appear
> in the previous module anywhere.  Where do they belong?

You are right. The EKUs id-kp-cmcCA and id-kp-cmcRA must be imported from RFC6402 and can be deleted from this draft. But the id-kp-cmKGA must be specified here, right? 

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Mon, 27 Jul 2020 12:26:25 -0400

> On Jul 27, 2020, at 12:22 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
> 

Right, so it is just and updated comment; however, the place were this is defined needs to be updated too, right?

> You are right. The EKUs id-kp-cmcCA and id-kp-cmcRA must be imported from RFC6402 and can be deleted from this draft. But the id-kp-cmKGA must be specified here, right? 

Yes, that is correct.

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 28 Jul 2020 05:57:19 +0000

> > My goal is to update OID {id-it 12}  as specified in section 5.3.19.9 and the
> only lines in the ASN.1 module on this OID is in comments?
> 

Yes. But the only place I am aware of where this OID is defined is in section 5.3.19.9 of RFC4210. I update this section in section 2.6 of the draft.
Are there any other place I should update?

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Tue, 28 Jul 2020 11:53:31 -0400

> Are there any other place I should update?

If that is the case, I suspect that all of the id-it- OID values need to appear in this new module.

Looking at RFC 5912, is seem that Jim and Paul defined these constructs for this purpose:

~~~
 INFO-TYPE-AND-VALUE ::= TYPE-IDENTIFIER

 InfoTypeAndValue ::= SEQUENCE {
     infoType    INFO-TYPE-AND-VALUE.
                     &id({SupportedInfoSet}),
     infoValue   INFO-TYPE-AND-VALUE.
                     &Type({SupportedInfoSet}{@infoType}) }
~~~

This is probably something that should be carried forward.

So, for example, that would lead to this in the ASN.1 module:

~~~
    it-caProtEncCert INFO-TYPE-AND-VALUE ::= {
      CMPCertificate IDENTIFIED BY id-it-caProtEncCert  }
~~~

You need a statement like this for each of the id-it- OID values.

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 31 Jul 2020 10:05:14 +0000

Russ

After having another look into the ASN.1 module in RFC4210 it up to the implementer which ITV he/she wants to use. It is specified like this:

> >> Von: Russ Housley <mailto:[email-masked]>
> >>
> >>> On Jul 27, 2020, at 12:22 PM, Brockhaus, Hendrik
> >> <mailto:[email-masked]> wrote:
> >>>
> >>>> Third, id-it-revPassphrase (which is in a comment) is associated
> >>>> with EncryptedKey instead of EncryptedValue.
> >>>
> >> Right, so it is just and updated comment; however, the place were
> >> this is defined needs to be updated too, right?
> >
> > Yes. But the only place I am aware of where this OID is defined is in section
> 5.3.19.9 of RFC4210. I update this section in section 2.6 of the draft.
>                      &Type({SupportedInfoSet}{@infoType}) } ~~~
> 
>       CMPCertificate IDENTIFIED BY id-it-caProtEncCert  } ~~~
> 

Thanks for that hint. 
I added this section to the ASN.1 module:

   SupportedInfoSet INFO-TYPE-AND-VALUE ::= { ... }

   id-it-revPassphrase    OBJECT IDENTIFIER ::= {id-it 12}
      RevPassphraseValue      ::= EncryptedKey

In the ASN.1 module in RFC 4210 as well as RFC 5912 (page 50) all definitions for specific id-it OIDs are in comments and supposed to be uncommented according to the given environment.
Is it sufficient to only add id-it-revPassphrase, which I changed, to the ASN.1 module of CMP Updates?

Or would you recommend to copy the complete section 9 of RFC5912 to CMP Updates and perform the changes?

Hendrik