Subject: Re: [lamps] AlgorithmIdentifier parameters NULL value - Re: InfoTypeAndValue in CMP headers

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 21 Sep 2020 15:59:03 +0000

Russ

> Von: Russ Housley <[email-masked]> 
> 
>> David:
>>
>>> Hendrik:
>>>
>>> I think that draft-ietf-lamps-cmp-updates should be revised to say that the parameters field MUST NOT be present in the description of the Signing Key Pair Types (s 5.3.19.2), Encryption/Key Agreement Key Pair Types (s 5.3.19.3), and Preferred Symmetric Algorithm (s 5.3.19.4).
>> Here I disagree - why not allow CMP servers to specify specific key parameters, e.g., to accept only certain elliptic curve(s).
>>
> The parameter only allows one, so to do that, ECC would have to appear over and over.  If that is the right answer, much text needs to be added.
>

Sorry, I missed the continuation of this thread. 
I would add the following note to 5.3.19.2 and 5.3.19.3:
-------snip-------
Note: In case you whish to offer several EC curves, you need to put several id-ecPublicKey elements, one each per named curve.
-------snip-------
In Section 5.3.19.4 only one specific symmetric algorithm with specific parameters can be specified. I think the note above is not required there.
Does this solve your issue?

- Hendrik

---

From: Russ Housley <[email-masked]>
Date: Mon, 21 Sep 2020 12:01:54 -0400

> In Section 5.3.19.4 only one specific symmetric algorithm with specific parameters can be specified. I think the note above is not required there.

The parameters for a symmetric encryption algorithm is normally an IV.  That should not appear here; just the OID is needed.

> Does this solve your issue?

Yes.

Russ