Subject: [lamps] Review of the ASN.1 in draft-ietf-lamps-cmp-updates

From: Russ Housley <[email-masked]>
Date: Sun, 14 Nov 2021 12:58:43 -0500

I had a few minutes, so I tried to compile the ASN.1 module.  I worked on Appendix A.2.  I will look at Appendix A.1 later.

ERRORS

Time, DistributionPointName, and GeneralNames need to be IMPORTed:

   Certificate, CertificateList, Time, id-kp
   FROM PKIX1Explicit-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}

   DistributionPointName, GeneralNames, GeneralName, KeyIdentifier
   FROM PKIX1Implicit-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}

This definition does not compile:

   CertStatus ::= SEQUENCE {
       certHash    OCTET STRING,
       -- the hash of the certificate, using the same hash algorithm
       -- as is used to create and verify the certificate signature
       certReqId   INTEGER,
       -- to match this confirmation with the corresponding req/rep
       statusInfo  PKIStatusInfo OPTIONAL,
       hashAlg [0] AlgorithmIdentifier OPTIONAL
       -- the hash algorithm to use for calculating certHash
       -- SHOULD NOT be used in all cases where the AlgorithmIdentifier
       -- of the certificate signature specifies a hash algorithm
      }

Please change it to:

   CertStatus ::= SEQUENCE {
       certHash    OCTET STRING,
       -- the hash of the certificate, using the same hash algorithm
       -- as is used to create and verify the certificate signature
       certReqId   INTEGER,
       -- to match this confirmation with the corresponding req/rep
       statusInfo  PKIStatusInfo OPTIONAL,
       hashAlg [0] AlgorithmIdentifier{DIGEST-ALGORITHM, {...}} OPTIONAL
       -- the hash algorithm to use for calculating certHash
       -- SHOULD NOT be used in all cases where the AlgorithmIdentifier
       -- of the certificate signature specifies a hash algorithm
      }

NITS (in the body of the document)

Some places, a balk line appears between ASN.1 definitions in the body (see Sections 2.8 and 2.15), but other places the lines are one after the other without any whitespace (see Sections 2.2, 2.3, and 2.4).  Please pick one and use it throughout.

In Section 2.4, the second line is indented, and it should be at the same level as the previous line.

      id-it-certProfile  OBJECT IDENTIFIER ::= {id-it 21}
      CertProfileValue ::= SEQUENCE SIZE (1..MAX) OF UTF8String

Russ

---

From: Russ Housley <[email-masked]>
Date: Sun, 14 Nov 2021 15:05:02 -0500

I just had a few minutes to look at Appendix A.1.  As with the other module, Time, DistributionPointName, and GeneralNames need to be IMPORTed:

       Certificate, CertificateList, Extensions, Name, Time,
       AlgorithmIdentifier, id-kp
       --, UTF8String -- -- if required; otherwise, comment out
              FROM PKIX1Explicit88 {iso(1) identified-organization(3)
              dod(6) internet(1) security(5) mechanisms(5) pkix(7)
              id-mod(0) id-pkix1-explicit-88(18)}
       -- The import of Name is added to define CertificationRequest
       -- instead of importing it from PKCS#10 [RFC2986]

       DistributionPointName, GeneralNames, GeneralName, KeyIdentifier
              FROM PKIX1Implicit88 {iso(1) identified-organization(3)
              dod(6) internet(1) security(5) mechanisms(5) pkix(7)
              id-mod(0) id-pkix1-implicit-88(19)}

Russ

> On Nov 14, 2021, at 12:58 PM, Russ Housley <[email-masked]> wrote:
>

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 15 Nov 2021 15:14:39 +0000

Russ

Many thanks for taking a look at the ASN.1 modules.
I will perform the changes with the next update.

Hendrik

> Von: Russ Housley <[email-masked]>
> Gesendet: Sonntag, 14. November 2021 21:05
> 
> I just had a few minutes to look at Appendix A.1.  As with the other module,
> > I had a few minutes, so I tried to compile the ASN.1 module.  I worked on
> Appendix A.2.  I will look at Appendix A.1 later.
> >
> > ERRORS
> >
> > Some places, a balk line appears between ASN.1 definitions in the body
> (see Sections 2.8 and 2.15), but other places the lines are one after the other
> without any whitespace (see Sections 2.2, 2.3, and 2.4).  Please pick one and
> use it throughout.
> >