Subject: [lamps] CMP Update of CertificationRequest

From: Russ Housley <[email-masked]>
Date: Sun, 23 May 2021 15:20:14 -0400

Right now, CertificationRequest is being imported from PKCS#10.  It looks to me like CertificationRequest is also defined in RFC 6402. RFC 6402 is also an update to CMP.  Since the definition was pulled into the ASN.1 module for that update, does it make sense to do the same now?

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 25 May 2021 06:44:58 +0000

Russ

I am uncertain, if I got your suggestion right. 

> Von: Spasm <[email-masked]> Im Auftrag von Russ Housley
> 
> Right now, CertificationRequest is being imported from PKCS#10.  It looks to me
> like CertificationRequest is also defined in RFC 6402. 

Right, the ASN.1 module in RFC 6402 Appendix A. also defines CertificationRequest.

> RFC 6402 is also an update to CMP.

RFC 6402 updates CMC. Why do you think it also updates CMP?

> Since the definition was pulled into the ASN.1 module for that update,
> does it make sense to do the same now?

Do you suggest to import the definition of CertificationRequest from the ASN.1 modules in RFC 6402 instead of RFC 2986? 
Or do you suggest to directly add the new definition to the ASN.1 modules in CMP Updates?

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 May 2021 10:22:55 -0400

Hendrick:

Ouch.  I messed that up.  You are right, RFC 6402 is an update to CMC, not CMP.

However, RFC 6402 did choose to locally define CertificationRequest.  I believe this was done because there was a place to IMPORT for the newer ASN.1 syntax, but not the older.  That way, the two modules are defining exactly the same things, even though the newer syntax could IMPORT it from RFC 2986.

Maybe we should continue to IMPORT from RFC 2986 in the newer ASN.1 syntax, and define locally in the older ASN.1 syntax, with a comment that this structure matches the one defined in RFC 2986.  This definition can be lifted from RFC 6402, where Jim Schaad already did that work.

Russ

> On May 25, 2021, at 2:44 AM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 25 May 2021 14:45:08 +0000

Russ

> Von: Russ Housley <[email-masked]>
> 
> However, RFC 6402 did choose to locally define CertificationRequest.  I believe
> this was done because there was a place to IMPORT for the newer ASN.1 syntax,
> but not the older.  That way, the two modules are defining exactly the same
> things, even though the newer syntax could IMPORT it from RFC 2986.
> 
> Maybe we should continue to IMPORT from RFC 2986 in the newer ASN.1
> syntax, and define locally in the older ASN.1 syntax, with a comment that this
> structure matches the one defined in RFC 2986.  This definition can be lifted
> from RFC 6402, where Jim Schaad already did that work.

RFC 4210 Appendix F imports CertificationRequest from RFC 2986.

         CertificationRequest
                FROM PKCS-10 {iso(1) member-body(2)
                              us(840) rsadsi(113549)
                              pkcs(1) pkcs-10(10) modules(1) pkcs-10(1)}

         -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
         -- tags).  Alternatively, implementers may directly include
         -- the [PKCS10] syntax in this module

RFC 5912 Section 9 imports CertificationRequest from the updated PKCS#10 module from Section 5. Jim already points the used to possibly directly add the syntax here.

CertificationRequest
 FROM PKCS-10
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkcs10-2009(69)}
 -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
 -- tags).  Alternatively, implementers may directly include
 -- the [PKCS10] syntax in this module

Do you think we should change this and directly add the new syntax from RFC 6402 to modules in CMP Updates?

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 May 2021 10:48:23 -0400

> On May 25, 2021, at 10:45 AM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
> 

Suggestion:

New ASN.1 syntax: IMPORT from RFC 2986

Old ASN.1 syntax: IMPORT from RFC 6402

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 25 May 2021 15:30:00 +0000

Russ

I am still a little confused... Sorry
I am uncertain what you mean by new and old ASN.1 syntax.

> >> However, RFC 6402 did choose to locally define CertificationRequest.
> >> I believe this was done because there was a place to IMPORT for the
> >> newer ASN.1 syntax, but not the older.  That way, the two modules are
> >> defining exactly the same things, even though the newer syntax could
> IMPORT it from RFC 2986.
> >>
> >> syntax, and define locally in the older ASN.1 syntax, with a comment
> >> that this structure matches the one defined in RFC 2986.  This
> >> definition can be lifted from RFC 6402, where Jim Schaad already did that
> work.
> >

Do you refer to CMP Updates Appendix A.2 here and should I change the import of CertificationRequest from RFC 5912 to the one in RFC 2986 ?-)

> Old ASN.1 syntax: IMPORT from RFC 6402

Do you refer to CMP Updates Appendix A.1 here and should I exchange the import of CertificationRequest from RFC 2986 to the definition from RFC 6402 Appendix A.1.

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 May 2021 12:03:11 -0400

> I am uncertain what you mean by new and old ASN.1 syntax.

I was talking about Appendix A.1 (1988 ASN.1 Module = old ASN.1 syntax) and Appendix A.2 (2002 ASN.1 Module = new ASN.1 syntax).

> Do you refer to CMP Updates Appendix A.2 here and should I change the import of CertificationRequest from RFC 5912 to the one in RFC 2986 ?-)

I believe that they are equivalent, but RFC 5912 is probably easiest for the compiler.

> Do you refer to CMP Updates Appendix A.1 here and should I exchange the import of CertificationRequest from RFC 2986 to the definition from RFC 6402 Appendix A.1.

Yes, that is my suggestion.

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 25 May 2021 16:08:11 +0000

Russ

Thanks for clarifying!

> -----Ursprüngliche Nachricht-----
> Gesendet: Dienstag, 25. Mai 2021 18:03
> An: Brockhaus, Hendrik (T RDA CST SEA-DE) <[email-masked]>
> Cc: LAMPS WG <[email-masked]>
> Betreff: Re: [lamps] CMP Update of CertificationRequest
> 
> Hendrik:
> 
> I was talking about Appendix A.1 (1988 ASN.1 Module = old ASN.1 syntax) and
> Appendix A.2 (2002 ASN.1 Module = new ASN.1 syntax).
> 
> >>>> newer ASN.1 syntax, but not the older.  That way, the two modules
> >>>> are defining exactly the same things, even though the newer syntax
> >>>> could
> >> IMPORT it from RFC 2986.
> >>>>
> >>>> syntax, and define locally in the older ASN.1 syntax, with a
> >>>> comment that this structure matches the one defined in RFC 2986.
> >>>> This definition can be lifted from RFC 6402, where Jim Schaad
> >>>> already did that
> >> work.
> >>>
> >>> Do you think we should change this and directly add the new syntax
> >>> from RFC
> >> 6402 to modules in CMP Updates?
> >>
> >> Suggestion:
> >>
> > Do you refer to CMP Updates Appendix A.2 here and should I change the
> > import of CertificationRequest from RFC 5912 to the one in RFC 2986
> > ?-)
> 

Should I stick to the Import from RFC 5912 though?

> > Do you refer to CMP Updates Appendix A.1 here and should I exchange the
> import of CertificationRequest from RFC 2986 to the definition from RFC 6402
> Appendix A.1.
> 

OK, I will do the change in the next release.

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 May 2021 12:13:11 -0400

Hendrick:

Sorry it took so many messages to get to closure.

> On May 25, 2021, at 12:08 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
> 
> Thanks for clarifying!
> 

Fine with me.

> OK, I will do the change in the next release.

Thanks.

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 25 May 2021 16:16:05 +0000

Russ

The update is captured. 
Many thanks for your patience.

Hendrik

> Gesendet: Dienstag, 25. Mai 2021 18:13
> >>> I am still a little confused... Sorry I am uncertain what you mean
> >>> by new and old ASN.1 syntax.
> >>
> >> I was talking about Appendix A.1 (1988 ASN.1 Module = old ASN.1
> >> syntax) and Appendix A.2 (2002 ASN.1 Module = new ASN.1 syntax).
> >>
> >>>>>> I believe this was done because there was a place to IMPORT for
> >>>>>> the newer ASN.1 syntax, but not the older.  That way, the two
> >>>>>> modules are defining exactly the same things, even though the
> >>>>>> newer syntax could
> >>>> IMPORT it from RFC 2986.
> >>>>>>
> >>>>>> Maybe we should continue to IMPORT from RFC 2986 in the newer
> >>>>>> ASN.1 syntax, and define locally in the older ASN.1 syntax, with
> >>>>>> a comment that this structure matches the one defined in RFC 2986.
> >>> Do you refer to CMP Updates Appendix A.2 here and should I change
> >>> the import of CertificationRequest from RFC 5912 to the one in RFC
> >>> 2986
> >>> ?-)
> >>
> >> import of CertificationRequest from RFC 2986 to the definition from
> >> RFC 6402 Appendix A.1.
> >>