Subject: [pkix] OCSP update: changing IMPORTS section of ASN.1 module

From: "David A. Cooper" <[email-masked]>
Date: Wed, 18 Aug 2010 14:25:26 -0400

All,

As I noted in during my presentation at IETF and in an editor's note in 
draft-cooper-pkix-rfc2560bis-00.txt, there is an oddity in the IMPORTS 
section of the OCSP ASN.1 module.  The ASN.1 module imports structures 
from three other modules:  PKIX1Implicit88, PKIX1Explicit88, and 
AuthenticationFramework.  What is odd is that the three structures 
imported from AuthenticationFramework (Certificate, AlgorithmIdentifier, 
and CRLReason) are also defined in PKIX1Implicit88 and PKIX1Explicit88, 
so I can't understand why these structures were imported from 
AuthenticationFramework rather than from the PKIX modules.

So, I am proposing to change the IMPORTS section of the ASN.1 module from:

    -- Directory Authentication Framework (X.509)
       Certificate, AlgorithmIdentifier, CRLReason
       FROM AuthenticationFramework { joint-iso-itu-t ds(5) module(1)
            authenticationFramework(7) 3 }

    -- PKIX Certificate Extensions
       AuthorityInfoAccessSyntax
       FROM PKIX1Implicit88 {iso(1) identified-organization(3)
            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
            id-mod(0) id-pkix1-implicit-88(2)}

       Name, GeneralName, CertificateSerialNumber, Extensions,
       id-kp, id-ad-ocsp
       FROM PKIX1Explicit88 {iso(1) identified-organization(3)
            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
            id-mod(0) id-pkix1-explicit-88(1)};

to:

    -- PKIX Certificate Extensions
       AuthorityInfoAccessSyntax, CRLReason
       FROM PKIX1Implicit88 {iso(1) identified-organization(3)
            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
            id-mod(0) id-pkix1-implicit-88(2)}

       Name, GeneralName, CertificateSerialNumber, Extensions,
       id-kp, id-ad-ocsp, Certificate, AlgorithmIdentifier
       FROM PKIX1Explicit88 {iso(1) identified-organization(3)
            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
            id-mod(0) id-pkix1-explicit-88(1)};

I have already checked, and this is a change that we can make to the 
ASN.1 module without changing the module's OID.  I am hoping that this 
change would not result in a change to the output of ASN.1 compilers 
that would require corresponding changes to application code.

Would anyone have a problem if I made this change?

Thanks,

Dave