Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt - ASN.1 typos

From: "Manger, James H" <[email-masked]>
Date: Thu, 4 Dec 2003 11:18:18 +1000

Russ,

I still think I am right.  Does your compiler compile complex values, or just types?

Very early versions of ASN.1 (X.208 1998/1990?) may have allowed the identifier (field name) to be omitted, but subsequent versions (X.680 1994/...) corrected this to avoid ambiguities.  Perhaps you have a lenient compiler (nice sometimes, but not when writing standards).

Much of draft-ietf-pkix-rsa-pkalgs-01.txt is based on PKCS #1 v2.1 where the ASN.1 is correct: it includes identifiers & type name and there are no squiggly brackets {} around octet string values.

Extracts from sections 24.17, 16.13, 22.3 & 11.12.1 of X.680 ASN.1 (2002):

	SequenceValue ::=
		  "{" ComponentValueList "}"
		| "{" "}"

	ComponentValueList ::=
		  NamedValue
		| ComponentValueList "," NamedValue

	NamedValue = identifier Value

	NOTE- The "identifier" is part of the notation,
	it does not form part of the value itself.
	It is used to unambiguously refer to the components
	of a set type, sequence type or choice type.

	OctetStringValue ::=
		  bstring
		| hstring
		| CONTAINING Value

	.. "hstring" ..
		EXAMPLE- 'AB0196'H

Extracts from sections D.2 of X.681 ASN.1 Information object spec (2002):

	ExampleType ::= SEQUENCE {
		openTypeComponent1  EXAMPLE-CLASS.&TypeField,
		integerComponent1   EXAMPLE-CLASS.&fixedTypeValueField,
		openTypeComponent2  EXAMPLE-CLASS.&variableTypeValueField,
		integerComponent2   EXAMPLE-CLASS.&FixedTypeValueSetField,
		openTypeComponent3  EXAMPLE-CLASS.&VariableTypeValueSetField
	}
	exampleValue ExampleType ::= {
		openTypeComponent1	BOOLEAN : TRUE,
		integerComponent1		123,
		openTypeComponent2	IA5String : "abcdef",
		integerComponent2		456,
		openTypeComponent3	BIT STRING : '0101010101'B
	}

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Thursday, 4 December 2003 6:05 AM
To: Manger, James H; [email-masked]
Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt - ASN.1
typos

James:

After changing:
       sha224WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 XX }
to:
       sha224WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 14 }

The module compiles fine for me.

Russ

At 09:54 AM 12/3/2003 +1000, Manger, James H wrote:

>The ASN.1 module in draft-ietf-pkix-rsa-pkalgs-01.txt has some typos.
>
>1.
>When specifying ASN.1 values the field names must be included.  When 
>specifying open type values the type must be specified.  For instance:
>
>WRONG:
>         sha1Identifier AlgorithmIdentifier ::=
>                 { id-sha1, NULL }
>
>RIGHT:
>         sha1Identifier AlgorithmIdentifier ::=
>                 { algorithm id-sha1, parameters NULL:NULL }
>
>These errors affect all 31 values of the following types: 
>AlgorithmIdentifier, RSASSA-PSS-params & RSAES-OAEP-params.
>
>
>2.
>In section 4.1 and in the ASN.1 module:
>WRONG:  nullOctetString OCTET STRING (SIZE (0)) ::= { ''H }
>RIGHT:  nullOctetString OCTET STRING (SIZE (0)) ::= ''H
>
>----------
>From: [email-masked] [mailto:[email-masked]]
>Sent: Wednesday, 3 December 2003 7:36 AM
>
>         Title           : Additional Algorithms and Identifiers for RSA
>                           Cryptography for use in the Internet X.509
>                           Public Key Infrastructure Certificate and
>                           Certificate Revocation List (CRL) Profile
>         Author(s)       : R. Housley, B. Kaliski
>         Filename        : draft-ietf-pkix-rsa-pkalgs-01.txt
>         Pages           : 22
>         Date            : 2003-12-2
>
>This document supplements RFC 3279.  It describes the conventions for 
>using the RSASSA-PSS signature algorithm, the RSAES-OAEP key transport 
>algorithm, and additional one-way hash functions with the PKCS #1 version 
>1.5 signature algorithm in the Internet X.509 Public Key Infrastructure 
>(PKI).  Encoding formats, algorithm identifiers, and parameter formats are 
>specified.
>
>http://www.ietf.org/internet-drafts/draft-ietf-pkix-rsa-pkalgs-01.txt

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 3 Dec 2003 19:27:04 -0800

James,

The PKIX working group requires that all ASN.1 be the 1988 version.  The
changes you are claming as non-compliant are not required for the 1988
version.

jim

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Manger, James H
> Sent: Wednesday, December 03, 2003 5:18 PM
> To: [email-masked]
> Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt 
> - ASN.1 typos
> 
> 
> 
> Russ,
> 
> Very early versions of ASN.1 (X.208 1998/1990?) may have 
> allowed the identifier (field name) to be omitted, but 
> subsequent versions (X.680 1994/...) corrected this to avoid 
> ambiguities.  Perhaps you have a lenient compiler (nice 
> sometimes, but not when writing standards).
> 
> Much of draft-ietf-pkix-rsa-pkalgs-01.txt is based on PKCS #1 
> v2.1 where the ASN.1 is correct: it includes identifiers & 
> type name and there are no squiggly brackets {} around octet 
> string values.
> 
> 
> Subject: RE: RSA Algs: 01: draft-ietf-pkix-rsa-pkalgs-01.txt 
> - ASN.1 typos
> 
> 
> James:
> 
> After changing:

---

From: Steven Legg <[email-masked]>
Date: Thu, 04 Dec 2003 15:03:48 +1100

Jim,

> changes you are claming as non-compliant are not required for the 1988

But they're not disallowed either. Why use a notation from 1988 which is
deprecated by later editions of ASN.1 when there is alternative notation
that is valid in 1988 and all later editions of ASN.1. ?

Regards,
Steven

>>>specifying open type values the type must be specified.  For 
>>
>>instance:
>>
>>>WRONG:
>>>        Title           : Additional Algorithms and 
>>
>>Identifiers for RSA
>>
>>>using the RSASSA-PSS signature algorithm, the RSAES-OAEP key 
>>
>>transport 
>>
>>>algorithm, and additional one-way hash functions with the 
>>
>>PKCS #1 version 
>>
>>>1.5 signature algorithm in the Internet X.509 Public Key 
>>
>>Infrastructure 
>>
>>>(PKI).  Encoding formats, algorithm identifiers, and 
>>
>>parameter formats are 
>>
>>>specified.
>>>

---

From: "Phillip H. Griffin" <[email-masked]>
Date: Thu, 04 Dec 2003 08:25:30 -0500

X.208 and X.209 are no longer merely deprecated. They have been
withdrawn as international standards since last year. From
http://www.itu.int/ITU-T/studygroups/com17/changing-ASN/migration.html

"The term ASN.1:1988/1990 notation is used to refer to that ASN.1
notation specified in CCITT Rec. X.208 which was withdrawn in 2002.

Phil