Subject: [pkix] [Errata Held for Document Update] RFC7030 (4384)

From: RFC Errata System <[email-masked]>
Date: Wed, 19 Aug 2020 12:58:55 -0700 (PDT)

The following errata report has been held for document update 
for RFC7030, "Enrollment over Secure Transport". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid4384

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Pierce Leonberger <[email-masked]>
Date Reported: 2015-06-02
Held by: Roman Danyliw (IESG)

Section: 4.5.2

Original Text
-------------
CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID

AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }

Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
     type   ATTRIBUTE.&id({IOSet}),
     values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }

Corrected Text
--------------
AttrOrOID ::= CHOICE {
      oid OBJECT IDENTIFIER, 
      attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
}

Notes
-----
1. The AttrOrOID CHOICE was started with a '(' versus a '{'.

2. Attribute{} is a parameterized type and you are missing the parameter reference within the AttrOrOID CHOICE for "attribute".

3. You need to define or reference the object set to be used in #2.

Highly recommend you create an ASN.1 Module as part of this specification.  This will make it clear which specifications (and the versions there of) you are importing types from (i.e. Attribute{}) and the tagging that should be used (module level).  If you need to define a new object set for #3 then this new module would be the perfect home for it.

--------------------------------------
RFC7030 (draft-ietf-pkix-est-09)
--------------------------------------
Title               : Enrollment over Secure Transport
Publication Date    : October 2013
Author(s)           : M. Pritikin, Ed., P. Yee, Ed., D. Harkins, Ed.
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Dan Harkins <[email-masked]>
Date: Wed, 19 Aug 2020 13:59:40 -0700

Hi there,

> for RFC7030, "Enrollment over Secure Transport".

   "YouNeedToDefined...." needs to be a list of OIDs I believe. Since this
is a request to someone on how to generate a CSR, the OIDs should be the
ones that would be useful when giving such instruction. For instance:

   - "Generate a CSR with a public key from p384, add your serialNumber
      as an extReq, include challengePassword, and sign the whole thing
      with ECDSA and SHA384"

   - "Generate a CSR with RSA and a key that is 4096 bits, include
      challengePassword and sign the whole thing with RSA and SHA512"

So how about this:

   AttrOrOID ::= CHOICE {
        oid OBJECT IDENTIFER,
        attribute AttrSet
   }

   AttrSet ATTRIBUTE ::= { challengePassword, id-ecPublicKey, rsaEncryption,
                           extReq, ecdsa-with-SHA256, ecdsa-with-SHA384,
                           ecdsa-with-SHA512, SHA256, SHA384, SHA512, ... }

   Would this work? This is basically what I implemented in my EST reference
design (plus some extra stuff like for extReq like macAddress, 
favoriteDrink,
etc that might be considered part of "...").

   regards,

   Dan.

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Jim Schaad <[email-masked]>
Date: Wed, 19 Aug 2020 17:52:43 -0700

-----Original Message-----
From: pkix <[email-masked]> On Behalf Of Dan Harkins
Sent: Wednesday, August 19, 2020 2:00 PM
To: RFC Errata System <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [pkix] [Errata Held for Document Update] RFC7030 (4384)

   Hi there,

On 8/19/20 12:58 PM, RFC Errata System wrote:
> The following errata report has been held for document update for 
> RFC7030, "Enrollment over Secure Transport".
>

   "YouNeedToDefined...." needs to be a list of OIDs I believe. Since this is a request to someone on how to generate a CSR, the OIDs should be the ones that would be useful when giving such instruction. For instance:

[JLS] YouNeedToDefined needs to be an ObjectSet of Attributes.  An attribute is going to have both an OID and a Type in it.

So how about this:

   AttrOrOID ::= CHOICE {
        oid OBJECT IDENTIFER,
        attribute AttrSet
   }

[JLS]
Items like challengePassword can be imported from RFC 2985.  However id-ecPublicKey is an OID so the ATTRIBUTE would need to be defined
att-ecPublicKey ::= ATTRIBUTE ::= { WITH SYNTAX ECParameters ID id-ecPublicKey }

Making an ASN.1 module would shake out which are needed to be defined as attributes.  I would use SHA256 in the oid choice myself.  Having an value set there would be useful so that people know which values go in which choices.

Jim

   Would this work? This is basically what I implemented in my EST reference design (plus some extra stuff like for extReq like macAddress, favoriteDrink, etc that might be considered part of "...").

   regards,

   Dan.

---

From: Russ Housley <[email-masked]>
Date: Thu, 20 Aug 2020 13:44:35 -0400

> Making an ASN.1 module would shake out which are needed to be defined as attributes.  I would use SHA256 in the oid choice myself.  Having an value set there would be useful so that people know whi…

Please see the ASN.1 module in draft-ietf-lamps-rfc7030est-clarify.

Russ