Subject: Re: I-D ACTION:draft-ietf-smime-escertid-00.txt

From: Peter Sylvester <[email-masked]>
Date: Sun, 02 Apr 2006 18:04:52 +0200

My comment was related to the syntax.

Another option would be not to use a fixed default but rather make the
hashAlgoritm OPTIONAL and say that it is the same as used in
to create the signature around (or SHA1 if the hash length is less than 
224 bits)

If one still use the same attribute: the implementations that understand
sha256- in a signature and use ESSCertID would be hit.

But as P.G. said, if one uses another attribute...

Peter Gutmann wrote:
> Peter Sylvester <[email-masked]> writes:
>
>   
>> ESSCertIDv2 ::= SEQUENCE {
>>    certHash         Hash,
>>    issuerSerial     IssuerSerial OPTIONAL,
>>    hashAlgorithm    [0] AlgorithmIdentifier DEFAULT { { algorithm sha-1, parameters NULL} }
>>     
>
> It'd be easier to just go with Russ' suggestion of:
>
> ESSCertIDv2 ::= SEQUENCE {
>     hashAlgorithm    AlgorithmIdentifier DEFAULT { { algorithm sha-1, parameters NULL} }
>     certHash         Hash,
>     issuerSerial     IssuerSerial OPTIONAL
>     }
>
> See my earlier message on why this won't present any backwards-compatibility
> problems with the original ESSCertID.
>
> Peter.
>
>
>
>   

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

---

From: Russ Housley <[email-masked]>
Date: Mon, 03 Apr 2006 11:30:23 -0400

Peter:

I do not see a way to use this syntax and say that the parameters are 
absent.  I prefer absent to NULL.

Russ

---

From: Blake Ramsdell <[email-masked]>
Date: Mon, 3 Apr 2006 11:52:09 -0700

On Apr 3, 2006, at 8:30 AM, Russ Housley wrote:
> I do not see a way to use this syntax and say that the parameters  
> are absent.  I prefer absent to NULL.

Now we get back into the "Great Algorithm Identifier Parameters  
Debate of 1997" where we discuss the merits of NULL vs. absent for  
algorithm identifiers. Early implementations looking for SHA-1 as an  
AlgorithmIdentifier expected NULL as parameters also.

So despite the personal preference (which I think influenced some of  
this discussion in CMS and MSG), the old school practice with  
AlgorithmIdentifiers was "NULL for parameters".

Blake
--
Blake Ramsdell | Sendmail, Inc. | http://www.sendmail.com

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 04 Apr 2006 13:30:46 +1200

Russ Housley <[email-masked]> writes:
>I do not see a way to use this syntax and say that the parameters are absent.
>I prefer absent to NULL.

Oh, I was just quoting Peter Sylvester's ASN.1, since he's using current ASN.1
which can't be used in IETF RFCs anyway, it shouldn't be an issue, the
parameter info will just disappear once it's back-translated in the obsolete
1988 form.

Peter.