Subject: [pkix] OCSP update: more changes to ASN.1 module

From: "David A. Cooper" <[email-masked]>
Date: Thu, 19 Aug 2010 12:04:51 -0400

All,

I have discovered two more issues in the OCSP ASN.1 module, that I would
like to address.

First, there is an error in the IMPORTS section of the module.  It
imports GeneralName from PKIX1Explicit88, but GeneralName is defined in
PKIX1Implicit88.

Second, when RFC 3280 was published, it contained some changes to the
ASN.1 from RFC 2459, and the module OIDs were changed.  So, I would like
to change the OCSP module to specify the new OIDs for PKIX1Explicit88
and PKIX1Implicit88.  (The ASN.1 module for the preferred signature
algorithms extension, OCSP-AGILITY-88, already specifies the new OID for
PKIX1Explicit88.)

I have attached two HTML files that highlight the differences in the
PKIX1Explicit88 and PKIX1Implicit88 modules between RFC 2459 and
RFC 5280.  From what I can tell, the only difference in the ASN.1 modules
that would be relevant to OCSP is the change in the CRLReason structure:

     CRLReason ::= ENUMERATED {
          unspecified             (0),
          keyCompromise           (1),
          cACompromise            (2),
          affiliationChanged      (3),
          superseded              (4),
          cessationOfOperation    (5),
          certificateHold         (6),
          removeFromCRL           (8),
          privilegeWithdrawn      (9),
          aACompromise           (10) }

The reason codes "privilegeWithdrawn" and "aACompromise" did not appear
in the version of PKIX1Implicit88 in RFC 2459.

If these changes were to be made along with the one that I proposed
yesterday, the IMPORTS section of the OCSP module would be:

      -- PKIX Certificate Extensions
         AuthorityInfoAccessSyntax, CRLReason, GeneralName
         FROM PKIX1Implicit88 { iso(1) identified-organization(3)
              dod(6) internet(1) security(5) mechanisms(5) pkix(7)
              id-mod(0) id-pkix1-implicit(19) }

         Name, CertificateSerialNumber, Extensions,
         id-kp, id-ad-ocsp, Certificate, AlgorithmIdentifier
         FROM PKIX1Explicit88 { iso(1) identified-organization(3)
              dod(6) internet(1) security(5) mechanisms(5) pkix(7)
              id-mod(0) id-pkix1-explicit(18) };