Subject: [pkix] Concluding OCSP Agility

From: Stefan Santesson <[email-masked]>
Date: Tue, 08 Mar 2011 01:41:20 +0100

The OCSP agility draft sits with the IESG with an "new ID needed" status.

However, I don't think we got a clear consensus on whether to use Algorithm
identifier or SMIMECapabilities.

The structure at hand is:

PreferredSignatureAlgorithms ::= SEQUENCE OF
                                       PreferredSignatureAlgorithm
      PreferredSignatureAlgorithm ::= SEQUENCE {
         sigIdentifier   AlgorithmIdentifier,
         certIdentifier  AlgorithmIdentifier OPTIONAL
         }

There is now a new PKIX draft for S/MIME Capabilities for public key
definitions which may help move forward on this issue.

The primary proposal as I recall this is to change the certIdentifier into
SMIMECapabilities as that would allow better specification of public keys
and their parameters.

Secondly I recall that we should change the name of certIdentifier to
something better as it sounds like an identifier of a certificate which it
is not.
More suitable would be pubKeyAlgIdentifier since this is an identifier of
the preferred algorithm of the public key in the responders certificate.

The changed syntax would then be:

      PreferredSignatureAlgorithm ::= SEQUENCE {
         sigIdentifier        AlgorithmIdentifier,
         pubKeyAlgIdentifier  SMIMECapabilities OPTIONAL
         }

Would the list agree to this change?

/Stefan

---

From: Sean Turner <[email-masked]>
Date: Wed, 09 Mar 2011 13:53:55 -0500

On 3/7/11 7:41 PM, Stefan Santesson wrote:
> However, I don't think we got a clear consensus on whether to use
> Algorithm identifier or SMIMECapabilities.
>
> The primary proposal as I recall this is to change the certIdentifier
> into SMIMECapabilities as that would allow better specification of
> public keys and their parameters.
>
> something better as it sounds like an identifier of a certificate which
> it is not.
> More suitable would be pubKeyAlgIdentifier since this is an identifier
> of the preferred algorithm of the public key in the responders certificate.
>

<no hat on>

I for one am happy with this.

spt

</no hat on>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 9 Mar 2011 10:33:15 -0500

At 1:41 AM +0100 3/8/11, Stefan Santesson wrote:
>The primary proposal as I recall this is to change the 
>certIdentifier into SMIMECapabilities as that would allow better 
>specification of public keys and their parameters.
>
>Secondly I recall that we should change the name of certIdentifier 
>to something better as it sounds like an identifier of a certificate 
>which it is not.
>More suitable would be pubKeyAlgIdentifier since this is an 
>identifier of the preferred algorithm of the public key in the 
>responders certificate.
>

I am comfortable with this change.

Steve

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 11 Mar 2011 11:32:18 +0100

I made an error in the suggested ASN.1

It should not be SMIMECapabilities, it should be SMIMECapability.
SMIMECapabilities is a SEQUENCE OF SMIMECapability. There is no reason for
such sequence in the structure.

The correct ASN.1 should be:

     PreferredSignatureAlgorithm ::= SEQUENCE {
        sigIdentifier        AlgorithmIdentifier,
        pubKeyAlgIdentifier  SMIMECapability OPTIONAL
        }

/Stefan

On 11-03-09 4:33 PM, "Stephen Kent" <[email-masked]> wrote:

>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 11 Mar 2011 13:05:14 +0100

A new draft has been submitted

http://tools.ietf.org/rfcdiff?url2=draft-ietf-pkix-ocspagility-10.txt

In particular, please check the change in section 8.1. It's revision was
requested by IESG, but I'm not entirely sure what the original text
intended to say.

I.e:
   "In such
   circumstances the responder MUST NOT generate a signature for a
   signing mechanism that is considered unacceptably insecure."

Jim, it would be great if you could check if the ASN.1 changes are OK.

/Stefan

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 31 Mar 2011 13:44:12 +0200

I realize that I am late on this.

The definition that I use for these two types are:

SMIMECapabilities is what party A uses to request that party B uses one of a
set of algorithms in talking to it.

AlgorithmIdentifier is what party A uses to tell party B what algorithm is
actually being used.

This separation makes it clear (at least to me) exactly when one should use
each of these items.

Jim

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Stefan Santesson
Sent: Tuesday, March 08, 2011 1:41 AM
To: pkix
Subject: [pkix] Concluding OCSP Agility

         }

         }

/Stefan