Subject: Re: WG LTANS meeting Summary - July 10th, 2006
From: Peter Sylvester <[email-masked]>
To: Tobias Gondrom <[email-masked]>
Cc: [email-masked], Russ Housley <[email-masked]>, [email-masked], [email-masked], Carl Wallace <[email-masked]>
Date: Thu, 13 Jul 2006 15:32:48 +0200
List-Id: <ietf-ltans.imc.org>

As I understand there was a remark probably concerning the
the import of AlgorithmIdentifier in ERS.

I have found at least three different definitions, the first one is not
current asn1 syntax any more, and does not allow to specify properly
several constraints.
The second is from X.509, it allows constaints via
the SupportedAlgorithms as a global global feature.
The third one come from pkcs1.

PKIX88:

AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }

AuthenticationFramework

ALGORITHM ::= *TYPE-IDENTIFIER*
AlgorithmIdentifier ::= *SEQUENCE* {
  algorithm   ALGORITHM <http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2005/AuthenticationFramework.html#AuthenticationFramework.ALGORITHM>.&id({SupportedAlgorithms <http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2005/AuthenticationFramework.html#AuthenticationFramework.SupportedAlgorithms>}),
  parameters  ALGORITHM <http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2005/AuthenticationFramework.html#AuthenticationFramework.ALGORITHM>.&Type({SupportedAlgorithms <http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2005/AuthenticationFramework.html#AuthenticationFramework.SupportedAlgorithms>}{@algorithm}) *OPTIONAL*
}

SupportedAlgorithms ALGORITHM <http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2005/AuthenticationFramework.html#AuthenticationFramework.ALGORITHM> ::=
  {...}

pkcs1:

ALGORITHM-IDENTIFIER ::= TYPE-IDENTIFIER
AlgorithmIdentifier { ALGORITHM-IDENTIFIER:InfoObjectSet } ::= SEQUENCE {
	algorithm	ALGORITHM-IDENTIFIER.&id({InfoObjectSet}),
	parameters	ALGORITHM-IDENTIFIER.&Type({InfoObjectSet} {@algorithm}) OPTIONAL
	}

The latter allows us to use something like inside some ERS specific 
module the
supported hash algorithms in a formal way, i.e. allowing a good
asn.1 tool to treat this automatically.

DigestAlgorithms 	ALGORITHM-IDENTIFIER ::= {
	{ NULL IDENTIFIED BY id-sha1 } 	|
	{ NULL IDENTIFIED BY id-sha256 } 	|
	{ NULL IDENTIFIED BY id-sha384 } 	|
	{ NULL IDENTIFIED BY id-sha512 },
	 ... -- Allows for future expansion
	}