Subject: RE: WG last call

From: Charles Lynn <[email-masked]>
Date: Tue, 16 Sep 2003 00:22:43 -0400 (EDT)

Jim,

Thanks for your comments on our draft.

Do the following address your concerns?

> 1. I don't understand doing a draft to define private extensions.
>    This is the phrase used in the abstract.used in the message.

We removed the "private" modifier.
(FYI, note that the PKIX arc under which the extensions are defined is
 id-pe- ... "private extensions")

> 2. I have a complete lack of understanding on how the IP adresses are
>    to be encoded.  Either a section on this needs to be added or a
>    reference to this needs to be place in the document.

A literal interpretation is that we only talk about ranges of IP
addresses, not an individual address as one might put into a host's
certificate.  We added text covering individual addresses and give
an example.

A more general interpretation is that the current text is not clear.
To cover the case where the comment is about the encoding of the
IPAddress and IPAddressRange types, introductory text has been added.
Does the following address your concerns?

   2.1.1.  Encoding of an IP Address or Prefix

   There are two families of IP addresses: IPv4 and IPv6.

   An IPv4 address is a 32-bit quantity that is written as four decimal
   numbers, each in the range 0 through 255, separated by a dot (".");
   10.5.0.5 is an example of an IPv4 address.

   An IPv6 address is a 128-bit quantity that is written as eight
   hexadecimal numbers, each in the range 0 through ffff, separated by a
   semicolon (":"); 2001:0:200:3:0:0:0:1 is an example of an IPv6
   address.  IPv6 addresses frequently have adjacent fields whose value
   is 0.  One such group of 0 fields may be abbreviated by two
   semicolons ("::").  The previous example may thus be represented by
   2001:0:200:3::1.

   An address prefix is a set of 2^k continuous addresses whose more-
   significant bits are identical.  For example, the set of 512 IPv4
   addresses from 10.5.0.0 through 10.5.1.255 all have the same 23 most-
   significant bits.  The set of addresses is written by appending a
   slash ("/") and the number of constant bits to the lowest address in
   the set.  The prefix for the example set is 10.5.0.0/23, and contains
   2^(32-23) = 2^9 addresses.  The set of IPv6 addresses
   2001:0:200:0:0:0:0:0 through 2001:0:3ff:ffff:ffff:ffff:ffff:ffff
   (2^89 addresses) is represented by 2001:0:200:0:0:0:0:0/39 or
   equivalently 2001:0:200::/39.  A prefix may be abbreviated by
   omitting the less-significant zero fields, but there should be enough
   fields to contain the indicated number of constant bits.  The
   abbreviated forms of the example IPv4 prefix is 10.5.0/23 and of the
   example IPv6 prefix is 2001:0:200/39.

   An IP address or prefix is encoded in the IP address delegation
   extension as a DER-encoded ASN.1 BIT STRING containing the constant
   most-significant bits.  Recall [X.690] that the DER encoding of a BIT
   STRING consists of the BIT STRING type (0x03), followed by (an
   encoding of) the number of value octets, followed by the value.  The
   value consists of an "initial octet" that specifies the number of
   unused bits in the last value octet, followed by the "subsequent
   octets" that contain the octets of the bit string.  (For IP
   addresses, the encoding of the length will be just the length.)

   In the case of a single address, all the bits are constant, so the
   bit string for an IPv4 address contains 32 bits.  The subsequent
   octets in the DER-encoding of the address 10.5.0.4 are 0x0a 0x05 0x00
   0x04.  Since all the bits in the last octet are used, the initial
   octet is 0x00.  The octets in the DER-encoded BIT STRING is thus:

        Type Len  Unused Bits ...
        0x03 0x05  0x00  0x0a 0x05 0x00 0x04

   Similarly, the DER-encoding of the prefix 10.5.0/23 is:

        Type Len  Unused Bits ...
        0x03 0x04  0x01  0x0a 0x05 0x00

   In this case the three subsequent octets contain 24 bits, but the
   prefix only uses 23, so there is one unused bit in the last octet,
   thus the initial octet is 1 (the DER require that all unused bits
   MUST be set to zero-bits).

   The DER-encoding of the IPv6 address 2001:0:200:3:0:0:0:1 is:

        Type Len  Unused Bits ...
        0x03 0x11  0x00  0x20 0x01 0x00 0x00 0x02 0x00 0x00 0x03
                         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x01

   and the DER-encoding of the prefix 2001:0:200/39, which has one
   unused bit in the last octet, is:

        Type Len  Unused Bits ...
        0x03 0x06  0x01  0x20 0x01 0x00 0x00 0x02

   2.1.2.  Encoding of a Range of IP Addresses

   While any contiguous range of IP addresses can be represented by a
   set of contiguous prefixes, a more concise representation is achieved
   by encoding the range as a SEQUENCE containing the lowest address and
   the highest address, where each address is encoded as a BIT STRING.
   Within the SEQUENCE, the bit string representing the lowest address
   in the range is formed by removing all the least-significant zero-
   bits from the address, and the bit string representing the highest
   address in the range is formed by removing all the least-significant
   one-bits.  The DER BIT STRING encoding requires that all the unused
   bits in the last octet MUST be set to zero-bits.  Note that a prefix
   can always be expressed as a range, but a range cannot always be
   expressed as a prefix.

   The range of addresses represented by the prefix 10.5.0/23 is
   10.5.0.0 through 10.5.1.255.  The lowest address ends in sixteen
   zero-bits that are removed.  The DER-encoding of the resulting
   sixteen-bit string is:

        Type Len  Unused Bits ...
        0x03 0x03  0x00  0x0a 0x05

   The highest address ends in nine one-bits that are removed.  The DER-
   encoding of the resulting twenty-three-bit string is:

        Type Len  Unused Bits ...
        0x03 0x04  0x01  0x0a 0x05 0x00

   The prefix 2001:0:200/39 can be encoded as a range where the DER-
   encoding of the lowest address (2001:0:200::) is:

        Type Len  Unused Bits ...
        0x03 0x06  0x01  0x20 0x01 0x00 0x00 0x02

   and the largest address (2001:0:3ff:ffff:ffff:ffff:ffff:ffff), which,
   after removal of the ninety least-significant one-bits leaves a
   thirty-eight bit string, is encoded as:

        Type Len  Unused Bits ...
        0x03 0x06  0x02  0x20 0x01 0x00 0x00 0x00

   The special case of all IP address blocks, i.e., a prefix of all
   zero-bits -- "0/0", MUST be encoded per the DER with a length octet
   of one, an initial octet of zero, and no subsequent octets:

        Type Len  Unused Bits ...
        0x03 0x01  0x00

   Note that for IP addresses the number of trailing zero-bits is
   significant.  For example, the DER-encoding of 10.64/12:

        Type Len  Unused Bits ...
        0x03 0x03  0x04  0x0a 0x40

   is different than the DER-encoding of 10.64.0/20:

        Type Len  Unused Bits ...
        0x03 0x04  0x04  0x0a 0x40 0x00
...
   2.2.3.8.  Element addressPrefix and Type IPAddress
...
   An IP address prefix is encoded as a BIT STRING.  The DER encoding of
   a BIT STRING uses the initial octet of the string to specify how many
   of the least-significant bits of the last subsequent octet are
   unused.  The DER encoding specifies that these unused bits MUST be
   set to zero-bits.

   Example:
             128.0.0.0       = 1000 0000.0000 0000.0000 0000.0000 0000
          to 143.255 255 255 = 1000 1111.1111 1111.1111 1111.1111 1111
        bit string to encode = 1000
              Type Len  Unused Bits ...
   Encoding = 0x03 0x02  0x04  0x80
...
   2.2.3.9.  Element addressRange and Type IPAddressRange

   The addressRange element is of type IPAddressRange.  The
   IPAddressRange type consists of a SEQUENCE containing a minimum
   (element min) and maximum (element max) IP address.  Each IP address
   is encoded as a BIT STRING.  The semantic interpretation of the
   minimum address in an IPAddressRange is that all the unspecified bits
   (for the full length of the IP address) are zero-bits.  The semantic
   interpretation of the maximum address is that all the unspecified
   bits are one-bits.  The BIT STRING for the minimum address results
   from removing all the least-significant zero-bits from the minimum
   address.  The BIT STRING for the maximum address results from
   removing all the least-significant one-bits from the maximum address.

   Example:
             129.64.0.0       = 1000 0001.0100 0000.0000 0000.0000 0000
          to 143.255.255.255  = 1000 1111.1111 1111.1111 1111.1111 1111
           minimum bit string = 1000 0001.01
           maximum bit string = 1000
   Encoding = SEQUENCE {
               Type Len  Unused Bits ...
        min    0x03 0x03  0x06  0x81      0x40
        max    0x03 0x02  0x04  0x80
              }

To cover the case where the comment is about the criteria used to
select which CHOICE is to be used, pseudo code has been added.

   2.2.3.7.  Type IPAddressOrRange

   The IPAddressOrRange type is a CHOICE of either an addressPrefix (an
   IP prefix or address) or an addressRange (an IP address range)
   element.

   This specification requires that any range of addresses that can be
   encoded as prefix MUST be encoded using an IPAddress element (a BIT
   STRING), and any range that cannot be encoded as a prefix MUST be
   encoded using an IPAddressRange (a SEQUENCE containing two BIT
   STRINGs).  The following pseudo code illustrates how to select the
   encoding of a given range of addresses.

        LET  N = the number of matching most-significant bits in the
                 lowest and highest addresses of the range
        IF   all the remaining bits in the lowest address are zero-bits
         AND all the remaining bits in the highest address are one-bits
        THEN the range MUST be encoded as an N-bit IPAddress
        ELSE the range MUST be encoded as an IPAddressRange

Are there other places where the text needs to be improved?

> 3. There is no ASN.1 module but this document defines new items.  (At
>    least there is no tagging so I don't need to know explicit vs implicit.)

Russ has assiged a module id, and an appendix has been added...

   Appendix A -- ASN.1 Module

   This normative appendix describes the IP address and AS identifiers
   extensions used by conforming PKI components in ASN.1 syntax.

   id-mod-ip-addr-and-as-ident  OBJECT IDENTIFIER ::= { iso(1)
            identified-organization(3) dod(6) internet(1) security(5)
            mechanisms(5) pkix(7) mod(0) 30 }
   DEFINITIONS ::=
   BEGIN
   -- EXPORTS ALL --
   -- IMPORTS --
   IMPORTS
   -- PKIX specific OIDs and arcs --
   id-pkix, id-pe FROM PKIX1Explicit88 { iso(1)
            identified-organization(3) dod(6) internet(1) security(5)
            mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) };

   -- IP Address Delegation Extension OID --
   id-pe-ipAddrBlock  OBJECT IDENTIFIER ::= { id-pe 7 }
   -- IP Address Delegation Extension Syntax --
   IPAddrBlocks        ::= SEQUENCE OF IPAddressFamily
   IPAddressFamily     ::= SEQUENCE { -- AFI & opt SAFI --
      addressFamily        OCTET STRING (SIZE (2..3)),
      ipAddressChoice      IPAddressChoice }
   IPAddressChoice     ::= CHOICE {
      inherit              NULL, -- inherit from issuer --
      addressesOrRanges    SEQUENCE OF IPAddressOrRange }
   IPAddressOrRange    ::= CHOICE {
      addressPrefix        IPAddress,
      addressRange         IPAddressRange }
   IPAddressRange      ::= SEQUENCE {
      min                  IPAddress,
      max                  IPAddress }
   IPAddress           ::= BIT STRING

   -- Autonomous System Identifier Delegation Extension OID --
   id-pe-autonomousSysId  OBJECT IDENTIFIER ::= { id-pe 8 }
   -- Autonomous System Identifier Delegation Extension Syntax --
   ASIdentifiers       ::= SEQUENCE {
       asnum               [0] EXPLICIT ASIdentifierChoice OPTIONAL,
       rdi                 [1] EXPLICIT ASIdentifierChoice OPTIONAL }
   ASIdentifierChoice  ::= CHOICE {
      inherit              NULL, -- inherit from issuer --
      asIdsOrRanges        SEQUENCE OF ASIdOrRange }
   ASIdOrRange         ::= CHOICE {
       id                  ASId,
       range               ASRange }
   ASRange             ::= SEQUENCE {
       min                 ASId,
       max                 ASId }
   ASId                ::= INTEGER

   END

Charlie

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 15 Sep 2003 22:51:56 -0700

Charlie,

The text looks fine and I can now confirm that I understand how to
encode the fields in question.

The ASN.1 module has a couple of problems.

1.  The module should start as follows:

   id-mod-ip-addr-and-as-ident { iso(1)
            identified-organization(3) dod(6) internet(1) security(5)
            mechanisms(5) pkix(7) mod(0) 30 }
   DEFINITIONS ::=

2.  By convention the module name SHOULD start with an uppercase
character and is normally a simple text string that describes what the
module is for (i.e. PKIXAttributeCertificate).  You might wish to change
to module name something like IPAddressBlocks.

3.  You have imported the symbol ip-pkix, but the symbol is never
referenced in the module.  I would suggest removing it.

4.  You might wish to remove the line "-- IMPORTS --" since this is
uncommented immeadiately below.

5.  Optional change is to use "DEFINITIONS EXPLICIT TAGS" and remove the
two occuraces of EXPLICIT.  This is not important and would not change
anything.

Jim