Subject: [stir] draft-ietf-stir-certificates: ASN.1 Module

From: Sean Turner <[email-masked]>
Date: Mon, 6 Jun 2016 13:18:00 -0400

At last virtual interim, I took the action item to do the ASN.1 module.  Here’s what I think we need to do get it done:

0) This is way in the ASN.1 weeds, but we need to decide whether the ASN.1 tags will be explicit or implicit.  I’m hoping that we can just go with explicit because it’s the default, I think it makes debugging slightly easier at the expense of two bytes if you use the spid or range choices (see #1).  Also, the OCSP module is EXPLICIT so it’s kind of matchy-matchy there; X.509 certificates extensions are both explicitly and implicitly tagged extensions so nothing really to gain there.

If anybody coded this up with an IMPLICIT ASN.1 module please speak up now!

1) #0 was a bit of trick question because it turns out we need to add some tags to the TNEntry choice; two of the choices are of the same type and you would have gotten an error had you tried to compile the ASN.1 with either implicit or explicit tags so … we need to add the tags in s8:

OLD:

TNEntry ::= CHOICE {
	spid		ServiceProviderIdentifierList,
	range	TelephoneNumberRange,
	one		E164Number }

NEW:

TNEntry ::= CHOICE {
	spid		[0] ServiceProviderIdentifierList,
	range	[1] TelephoneNumberRange,
	one		     E164Number }

2) Do the following in s8 (we know which arc this OID will come from):

OLD:

  id-ce-TNAuthList OBJECT IDENTIFIER ::= { TBD }

NEW:

  id-ce-TNAuthList OBJECT IDENTIFIER ::= { id-ce TBD }

3) We need four OIDs.  Three of them are listed in the IANA section already we just need to add some words to get the ASN.1 module OID so do the following:

3.a) In s11, do the following replace:

OLD
  .. and the TN by reference AIA access descriptor
  defined in Section 9.3.

NEW: 
  .. the TN by reference AIA access descriptor
  defined in Section 9.3, and the ASN.1 module
  identifier defined in Appendix A.

3.b) Add the following to the bulleted list in s11:

 - The TN ASN.1 module in SMI Security for PKIX
   Module Identifier registry:
   http://www.iana.org/assignments/smi-numbers/
   smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.0

4) The following module needs to be added in Appendix A; it replaces the TBD that’s there now.  Note that Russ and I got this to compile albeit with dummy numbers in place of the 4 TBDs.

This ASN.1 module imports ASN.1 from [RFC5912].

TN-Module {
  iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) id-mod(0)
  id-mod-tn-module(TBD) }

  DEFINITIONS EXPLICIT TAGS ::= 
  BEGIN

  IMPORTS

  id-ad, id-ad-ocsp                                     -- From RFC 5912
  FROM PKIX1Explicit-2009 {
    iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51) }

  id-ce                                                -- From RFC 5912
  FROM PKIX1Implicit-2009 {
    iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59) }

  EXTENSION                                            -- From RFC 5912
  FROM PKIX-CommonTypes-2009 {
    iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) id-mod(0)
    id-mod-pkixCommon-02(57) }
  ;

  -- TN Entry Certificate Extension

  ext-tnAuthList  EXTENSION  ::= {
    SYNTAX TNAuthorizationList IDENTIFIED BY id-ce-TNAuthList }

  TNAuthorizationList ::= SEQUENCE SIZE (1..MAX) OF TNAuthorization

  TNAuthorization ::= SEQUENCE SIZE (1..MAX) OF TNEntry

  TNEntry ::= CHOICE {
	spid   [0] ServiceProviderIdentifierList,
	range  [1] TelephoneNumberRange,
	one		   E164Number }

  ServiceProviderIdentifierList ::= SEQUENCE SIZE (1..3) OF
                                      OCTET STRING

  -- When all three are present: SPID, Alt SPID, and Last Alt SPID

  TelephoneNumberRange ::= SEQUENCE {
    start E164Number,
    count INTEGER }

  E164Number ::= IA5String (SIZE (1..15)) (FROM ("0123456789"))

  -- TN OCSP Extension
  
  re-ocsp-tn-query  EXTENSION ::= {
    SYNTAX TNQuery IDENTIFIED BY id-pkix-ocsp-stir-tn }

  TNQuery ::= E164Number

  -- TN Access Descriptor
  
  id-ad-stir-tn          OBJECT IDENTIFIER ::= { id-ad TBD }

  --
  --  Object Identifiers
  --

  id-pkix-ocsp           OBJECT IDENTIFIER ::= id-ad-ocsp
  id-ce-TNAuthList       OBJECT IDENTIFIER ::= { id-ce TBD  }
  id-pkix-ocsp-stir-tn   OBJECT IDENTIFIER ::= { id-pkix-ocsp TBD }

END

5) We should add a normative reference to RFC 5912.

6) We should also go ahead and get these OID-related TBDs:

Chairs can this be considered the early IANA allocation request as per RFC 7120 or would you prefer a separate email to get that going?

spt

---

From: Russ Housley <[email-masked]>
Date: Mon, 6 Jun 2016 18:04:48 -0400

> Chairs can this be considered the early IANA allocation request as per RFC 7120 or would you prefer a separate email to get that going?

Once the ASN.1 module wis in an Internet-Draft, then we can ask the IESG to assign the OIDs if there is WG consensus to do so.

Russ