Subject: Re: [lamps] EST CSR attrs discussion

From: Michael Richardson <[email-masked]>
Date: Sun, 01 Aug 2021 17:25:55 -0400

Dan Harkins <[email-masked]> wrote:
    >   Sorry, I wasn't aware that this issue was being discussed and I wasn't
    > on the lamps/spasm list. But I'm largely responsible-- i.e. to blame-- for
    > the CSR Attrs text in RFC 7030 so perhaps I can try and explain.

okay.

RFC7030 section 4.5.2 includes the example:

       MEEGCSqGSIb3DQEJBzASBgcqhkjOPQIBMQcGBSuBBAAiMBYGCSqGSIb3DQEJDjEJ
       BgcrBgEBAQEWBggqhkjOPQQDAw==

obiwan-[~](2.6.6) mcr 10076 %base64 -d </tmp/k1 | dumpasn1 -
  0  65: SEQUENCE {
  2   9:   OBJECT IDENTIFIER challengePassword (1 2 840 113549 1 9 7)
 13  18:   SEQUENCE {
 15   7:     OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1)
 24   7:     SET {
 26   5:       OBJECT IDENTIFIER secp384r1 (1 3 132 0 34)
       :       }
       :     }
 33  22:   SEQUENCE {
 35   9:     OBJECT IDENTIFIER extensionRequest (1 2 840 113549 1 9 14)
 46   9:     SET {
 48   7:       OBJECT IDENTIFIER '1 3 6 1 1 1 1 22'
       :       }
       :     }
 57   8:   OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3)
       :   }

which sure looked to me like it's asking for extensionRequest with value 1.3.6.1.1.1.22.
Is it in fact asking for an extension of 1.3.6.1.1.1.22?
And ecPublicKey should have value 1.3.132.0.34.

(which presumably, also means you'd better provide a key of that algorithm)

It seems that some errata needs to be files.

The RFC899[45] design team included Max Pritikin, who seemed fine with the idea
that we could send values, but maybe he just missed this point.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Michael Richardson <[email-masked]>
Date: Sun, 01 Aug 2021 17:26:52 -0400

Eliot Lear <[email-masked]> wrote:
    > opaque, and really could stand for further elaboration, since it does seem
    > one CAN specify values.  The best way to do that is probably a draft, aiming
    > toward informational, but I'm out of bandwidth at the moment.

Well, I could write a draft, but it will return CBOR described by CDDL.

---

From: Russ Housley <[email-masked]>
Date: Mon, 9 Aug 2021 11:53:05 -0400

LAMPS WG:

Based on the Doodle poll results, I have requested a virtual session focused on the EST CSR Attrs topic using Meetecho on 30 Aug 2021 at 13:30 Eastern.  Expect an announcement from the Secretariat soon.

Russ