Subject: [Ietf-krb-wg] OTP draft - full tagged ASN.1 structures

From: "Srinivas Cheruku" <[email-masked]>
Date: Mon, 22 Jun 2009 15:03:34 +0530

Hi,

The tag numbers for all elements in the OTP ASN.1 structure like
PA-OTP-REQUEST are missing, where as Kerberos structures use tags for all
elements.

e.g.

             PA-OTP-REQUEST ::= SEQUENCE {
               flags             OTPFlags,
               nonce             OCTET STRING,
               encData           EncryptedData,
                                 -- PA-OTP-ENC-REQUEST or PA-ENC-TS-ENC
                                 -- Key usage of KEY_USAGE_OTP_REQUEST
               hashAlg           AlgorithmIdentifier OPTIONAL,
               iterationCount    Int32         OPTIONAL,
               otp-value         OCTET STRING    OPTIONAL,
               otp-challenge [0
<http://tools.ietf.org/html/draft-ietf-krb-wg-otp-preauth-10#ref-0> ] OCTET
STRING    OPTIONAL,
               otp-time          KerberosTime    OPTIONAL,
               otp-counter   [1
<http://tools.ietf.org/html/draft-ietf-krb-wg-otp-preauth-10#ref-1> ] OCTET
STRING    OPTIONAL,
               otp-format    [2
<http://tools.ietf.org/html/draft-ietf-krb-wg-otp-preauth-10#ref-2> ]
OTPFormat       OPTIONAL,
               otp-keyID     [3
<http://tools.ietf.org/html/draft-ietf-krb-wg-otp-preauth-10#ref-3> ] OCTET
STRING    OPTIONAL,
               otp-algID         AnyURI          OPTIONAL,
               ...
             }

You can see above, all elements are not tagged and this is the same case
with all structures.

Not using tags might cause ambiguity?

Thanks,
Srini

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Jun 2009 07:24:56 -0400

>>>>> "Srinivas" == Srinivas Cheruku <[email-masked]> writes:

    Srinivas> Hi, The tag numbers for all elements in the OTP ASN.1
    Srinivas> structure like PA-OTP-REQUEST are missing, where as
    Srinivas> Kerberos structures use tags for all elements.

While these tags are not required by the ASN.1 spec, at least for some
Kerberos implementations it would be far easier to implement ASN.1
that followed the Kerberos style.

OTOH, it is late in the process for this sort of change.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Srinivas Cheruku" <[email-masked]>
Date: Tue, 23 Jun 2009 17:04:59 +0530

>>>>> Sam Hartman [mailto:[email-masked]] writes:

>OTOH, it is late in the process for this sort of change.

I think Gareth can change the draft and I don't think it is too late.

Thanks,
Srini

---

From: <[email-masked]>
Date: Mon, 29 Jun 2009 07:32:28 -0400

As I mentioned in my reply, I have used tagging to resolve potential
ambiguity when there is more than one optional element of the same type.
I didn't believe that full tagging was required.

However, from Tom and Sam's replies to Srini's question, it does seem as
if full tagging would make parsing easier.  

Jeff & Larry, do you think that this change is required?

--Gareth

> -----Original Message-----
> From: Srinivas Cheruku [mailto:[email-masked]] 
> Sent: 23 June 2009 12:35
> To: 'Sam Hartman'
> Cc: Richards, Gareth; [email-masked]
> Subject: RE: [Ietf-krb-wg] OTP draft - full tagged ASN.1 structures
> 
> 
> >Kerberos implementations it would be far easier to implement 
> ASN.1 that 
> >followed the Kerberos style.
>

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Mon, 29 Jun 2009 09:00:30 -0700

I don't care which tagging your are using but prefer the full tagging  
for consistancy with other Kerberos documents.

Love