Subject: RE: SPNEGO-bis comments/questions

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Mon, 3 Jan 2005 23:44:16 -0800

I could not compile the ASN.1 module with the SIZE constrains using
Microsoft ASN.1 compiler.

Tom or is there someone else who can verify the correctness of this
syntax?

    SPNEGOASNOneSpec {          
       iso(1) identified-organization(3) dod(6) internet(1)           
       security(5) mechanism(5) snego (2) modules(4) spec2(2)
    } DEFINITIONS EXPLICIT TAGS ::= BEGIN     
   
    MechType ::= OBJECT IDENTIFIER           
        -- OID represents each security mechanism as suggested by

        -- [RFC2743]                     

    MechTypeList ::= SEQUENCE OF MechType       

    NegotiationToken ::= CHOICE {             
        negTokenInit    [0] NegTokenInit,             
        negTokenResp    [1] NegTokenResp          
    }  

    NegTokenInit ::= SEQUENCE {             
        mechTypes       [0] MechTypeList,             
        reqFlags        [1] ContextFlags  OPTIONAL,
          -- maintained from RFC 2478 for backward compatibility, 
          -- RECOMMENDED to be left out 
        mechToken       [2] OCTET STRING  OPTIONAL,             
        mechListMIC     [3] OCTET STRING  OPTIONAL,
        ...
    }          
    NegTokenResp ::= SEQUENCE {                 
        negState       [0] ENUMERATED {                     
            accept-completed    (0),                     
            accept-incomplete   (1),                     
            reject              (2),                     
            request-mic         (3)                     
        }                                 OPTIONAL,
          -- REQUIRED in the first reply from the target
        supportedMech   [1] MechType      OPTIONAL,    
          -- present only in the first reply from the target
        responseToken   [2] OCTET STRING  OPTIONAL,                 
        mechListMIC     [3] OCTET STRING  OPTIONAL,
        ...
    }  

    ContextFlags ::= BIT STRING (SIZE (32)) {             
        delegFlag       (0),             
        mutualFlag      (1),             
        replayFlag      (2),             
        sequenceFlag    (3),             
        anonFlag        (4),             
        confFlag        (5),             
        integFlag       (6)         
    } 

    END   

Also is there any issue w.r.t. allocating the relative-OIDs for the
SPNEGO ASN.1 module here?

iso(1) identified-organization(3) dod(6) internet(1)           
       security(5) mechanism(5) snego (2) modules(4) spec2(2)

-- Larry

-----Original Message-----
From: Tom Yu [mailto:[email-masked]] 
Sent: Monday, January 03, 2005 2:11 PM
To: Sam Hartman
Cc: Liqiang(Larry) Zhu; Simon Spero; [email-masked]; [email-masked]
Subject: Re: SPNEGO-bis comments/questions

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

>>>>> "Tom" == Tom Yu <[email-masked]> writes:
Tom> Please recall that applying a size constraint to BIT STRING with 
Tom> named bits requires that a DER encoder truncate trailing zero bits.

Tom> This caused interoperability problems for Kerberos.

Sam> doesn't DER already imply this?

Oops, yeah, it already does require the truncation, but the size
constraint doesn't change the truncation.

---Tom

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Tom Yu <[email-masked]>
Date: Tue, 04 Jan 2005 11:54:06 -0500

>>>>> "lzhu" == Liqiang\(Larry\) Zhu <Liqiang> writes:

lzhu> I could not compile the ASN.1 module with the SIZE constrains using
lzhu> Microsoft ASN.1 compiler.

lzhu>     ContextFlags ::= BIT STRING (SIZE (32)) {             
lzhu>         delegFlag       (0),             
lzhu>         mutualFlag      (1),             
lzhu>         replayFlag      (2),             
lzhu>         sequenceFlag    (3),             
lzhu>         anonFlag        (4),             
lzhu>         confFlag        (5),             
lzhu>         integFlag       (6)         
lzhu>     } 

Constraints, including size constraints, go after a type.  (There's an
exception for SEQUENCE OF and SET OF but we won't worry about that.)
The named bit list is part of the BIT STRING type.  Try moving the
size constraint so that it follows the named bit list.

lzhu> Also is there any issue w.r.t. allocating the relative-OIDs for the
lzhu> SPNEGO ASN.1 module here?

lzhu> iso(1) identified-organization(3) dod(6) internet(1)           
lzhu>        security(5) mechanism(5) snego (2) modules(4) spec2(2)

I'm not sure what you're asking.

---Tom

---

From: Simon Spero <[email-masked]>
Date: Tue, 04 Jan 2005 13:16:34 -0500

>       security(5) mechanism(5) snego (2) modules(4) spec2(2)
Should that read snego or spnego?

Who  owns 1.3.6.1.5.5.2?  If it's been delegated to kitten (SPNEKO?) then it's fair game. 

Simon