Subject: [lamps] draft-ietf-lamps-cmp-updates and the ASN.1 modules

From: Russ Housley <[email-masked]>
Date: Sat, 19 Sep 2020 10:06:15 -0400

Hendrik:

I have two comments on the ASN.1 modules.

(1) The new module says:

       CertTemplate, PKIPublicationInfo, EncryptedKey, EncryptedValue,
       CertId, CertReqMessages
              FROM PKIXCRMF-2005 {iso(1) identified-organization(3)
              dod(6) internet(1) security(5) mechanisms(5) pkix(7)
              id-mod(0) id-mod-crmf2005(36)}
       -- The import of EncryptedKey is added due to the updates made
       -- in CMP Updates [thisRFC]

EncryptedValue is not longer used in the module.  It should probably be put in a comment.

(2) This part is not changed, but I have a comment about it:

   Challenge ::= SEQUENCE {
       owf                 AlgorithmIdentifier{DIGEST-ALGORITHM, {...}}
                               OPTIONAL,
       -- MUST be present in the first Challenge; MAY be omitted in
       -- any subsequent Challenge in POPODecKeyChallContent (if
       -- omitted, then the owf used in the immediately preceding
       -- Challenge is to be used).
       witness             OCTET STRING,
       -- the result of applying the one-way function (owf) to a
       -- randomly-generated INTEGER, A.  [Note that a different
       -- INTEGER MUST be used for each Challenge.]
       challenge           OCTET STRING
       -- the encryption (under the public key for which the cert.
       -- request is being made) of Rand, where Rand is specified as
       --   Rand ::= SEQUENCE {
       --      int      INTEGER,
       --       - the randomly-generated INTEGER A (above)
       --      sender   GeneralName
       --       - the sender's name (as included in PKIHeader)
       --   }
   }

I've always thought it would help the implementer to make the Rand definition part of the ASN.1 module.

Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 21 Sep 2020 16:03:06 +0000

Russ

> Von: Russ Housley <[email-masked]>
> Gesendet: Samstag, 19. September 2020 16:06
> 
> Hendrik:
> 

Right. I will remove the import of EncryptedValue and add a respective comment.

> part of the ASN.1 module.

OK, I will move the declaration of Rand out of the comment.

- Hendrik