Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt - ASN.1 typos

From: "Manger, James H" <[email-masked]>
Date: Wed, 3 Dec 2003 09:54:07 +1000

The ASN.1 module in draft-ietf-pkix-rsa-pkalgs-01.txt has some typos.

1.
When specifying ASN.1 values the field names must be included.  When specifying open type values the type must be specified.  For instance:

WRONG:
	sha1Identifier AlgorithmIdentifier ::=
		{ id-sha1, NULL }

RIGHT:
	sha1Identifier AlgorithmIdentifier ::=
		{ algorithm id-sha1, parameters NULL:NULL }

These errors affect all 31 values of the following types: AlgorithmIdentifier, RSASSA-PSS-params & RSAES-OAEP-params.

2.
In section 4.1 and in the ASN.1 module:
WRONG:	nullOctetString OCTET STRING (SIZE (0)) ::= { ''H }
RIGHT:	nullOctetString OCTET STRING (SIZE (0)) ::= ''H

----------
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, 3 December 2003 7:36 AM

	Title		: Additional Algorithms and Identifiers for RSA 
			  Cryptography for use in the Internet X.509 
			  Public Key Infrastructure Certificate and 
			  Certificate Revocation List (CRL) Profile
	Author(s)	: R. Housley, B. Kaliski
	Filename	: draft-ietf-pkix-rsa-pkalgs-01.txt
	Pages		: 22
	Date		: 2003-12-2
	
This document supplements RFC 3279.  It describes the conventions for using the RSASSA-PSS signature algorithm, the RSAES-OAEP key transport algorithm, and additional one-way hash functions with the PKCS #1 version 1.5 signature algorithm in the Internet X.509 Public Key Infrastructure (PKI).  Encoding formats, algorithm identifiers, and parameter formats are specified.

http://www.ietf.org/internet-drafts/draft-ietf-pkix-rsa-pkalgs-01.txt

---

From: Russ Housley <[email-masked]>
Date: Wed, 03 Dec 2003 14:05:18 -0500

James:

After changing:
       sha224WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 XX }
to:
       sha224WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 14 }

The module compiles fine for me.

Russ

At 09:54 AM 12/3/2003 +1000, Manger, James H wrote:

>When specifying ASN.1 values the field names must be included.  When 
>specifying open type values the type must be specified.  For instance:
>
>WRONG:
>These errors affect all 31 values of the following types: 
>AlgorithmIdentifier, RSASSA-PSS-params & RSAES-OAEP-params.
>
>
>2.
>This document supplements RFC 3279.  It describes the conventions for 
>using the RSASSA-PSS signature algorithm, the RSAES-OAEP key transport 
>algorithm, and additional one-way hash functions with the PKCS #1 version 
>1.5 signature algorithm in the Internet X.509 Public Key Infrastructure 
>(PKI).  Encoding formats, algorithm identifiers, and parameter formats are 
>specified.
>

---

From: Russ Housley <[email-masked]>
Date: Thu, 04 Dec 2003 11:24:28 -0500

James:

I used the SNACC compliler (with the DigitalNet enhancements).

I changed the nullOcetString line to:

    nullOctetString  OCTET STRING (SIZE (0))  ::=  ''H

And, it compiler fine too.  Based on your research, I assume that SNACC is 
being forgiving in this situation.  We will change it in the next version 
of the Internet Draft.

Russ

At 11:18 AM 12/4/2003 +1000, Manger, James H wrote:

>Russ,
>
>I still think I am right.  Does your compiler compile complex values, or 
>just types?
>
>Very early versions of ASN.1 (X.208 1998/1990?) may have allowed the 
>identifier (field name) to be omitted, but subsequent versions (X.680 
>1994/...) corrected this to avoid ambiguities.  Perhaps you have a lenient 
>compiler (nice sometimes, but not when writing standards).
>
>Much of draft-ietf-pkix-rsa-pkalgs-01.txt is based on PKCS #1 v2.1 where 
>the ASN.1 is correct: it includes identifiers & type name and there are no 
>squiggly brackets {} around octet string values.
>
>
>Extracts from sections 24.17, 16.13, 22.3 & 11.12.1 of X.680 ASN.1 (2002):
>
>         SequenceValue ::=
>                   "{" ComponentValueList "}"
>                 | "{" "}"
>
>         ComponentValueList ::=
>                   NamedValue
>                 | ComponentValueList "," NamedValue
>
>         NamedValue = identifier Value
>
>         NOTE- The "identifier" is part of the notation,
>         it does not form part of the value itself.
>         It is used to unambiguously refer to the components
>         of a set type, sequence type or choice type.
>
>         OctetStringValue ::=
>                   bstring
>                 | hstring
>                 | CONTAINING Value
>
>         .. "hstring" ..
>                 EXAMPLE- 'AB0196'H
>
>
>Extracts from sections D.2 of X.681 ASN.1 Information object spec (2002):
>
>         ExampleType ::= SEQUENCE {
>                 openTypeComponent1  EXAMPLE-CLASS.&TypeField,
>                 integerComponent1   EXAMPLE-CLASS.&fixedTypeValueField,
>                 openTypeComponent2  EXAMPLE-CLASS.&variableTypeValueField,
>                 integerComponent2   EXAMPLE-CLASS.&FixedTypeValueSetField,
>                 openTypeComponent3  EXAMPLE-CLASS.&VariableTypeValueSetField
>         }
>         exampleValue ExampleType ::= {
>                 openTypeComponent1      BOOLEAN : TRUE,
>                 integerComponent1               123,
>                 openTypeComponent2      IA5String : "abcdef",
>                 integerComponent2               456,
>                 openTypeComponent3      BIT STRING : '0101010101'B
>         }
>
>
>-----Original Message-----
>From: Russ Housley [mailto:[email-masked]]
>Sent: Thursday, 4 December 2003 6:05 AM
>To: Manger, James H; [email-masked]
>Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt - ASN.1
>typos
>
>
>James:
>
>After changing: