Subject: Testing the ASN.1 in Part 1

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 14 Sep 1998 08:36:12 -0700

Greetings, all. I know that all this discussion of LDAP is fascinating, but
I'd like to come back to draft-ietf-pkix-ipki-part1 for a second. It is in
IESG last call, almost ready (we hope) to become an RFC. Tim has just made
minor tweaks to it (it is now -10.txt), and we're almost there.

Has anyone tested the full ASN.1 in part 1 lately? Given the anti-ASN.1
sentiment in the IETF, it would be Very Embarassing if we got an RFC and
had to revise it due to an ASN.1 error. Worse yet, it would be bad if there
was an error and two implementors did different things to get around it.

Anyone who plans to get around to checking the ASN.1 after part 1 becomes
an RFC: could you do it now instead? This would be a great help to us all.
Thanks!

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Dean Povey <[email-masked]>
Date: Tue, 15 Sep 1998 14:29:01 +1000

>an RFC: could you do it now instead? This would be a great help to us all.

*grr* I was putting this off :-)

I am using the 88ish syntax

PKIX1Explicit88 parses fine, but there are stuff ups in the imports in
PKIX1Implicit88 

To the IMPORTS section in PKIX1Implicit88 add the following:

id-pkix, BMPString, UniversalString, UTF8String

And delete the following two redundant definitions:

id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 } 

Other than that it looks like so far so good.  I'll have to do some more work 
until this is fully tested.

-- 
Dean Povey,         | e-m: [email-masked]     | Cryptozilla:
Research Scientist  | ph:  +61 7 3864 5120       |  www.cryptozilla.org/
Security Unit, DSTC | fax: +61 7 3864 1282       | Oscar - PKI Toolkit:
Brisbane, Australia | www: security.dstc.edu.au/ |  oscar.dstc.qut.edu.au/

---

From: Dean Povey <[email-masked]>
Date: Fri, 18 Sep 1998 15:47:57 +1000

>>an RFC: could you do it now instead? This would be a great help to us all.

More bugs in PKIX1ImplictXX

The ASN.1 for PolicyConstraints is incorrect. In both the 88 and 93 versions 
it is specified as a SEQUENCE SIZE(1..MAX) OF SEQUENCE { ... }.  This is 
inconsistent with the X.509 definition and it also doesn't make any sense for 
it to be a SEQUENCE OF.  The definition of PolicyConstraints should  be:

PolicyConstraints ::= SEQUENCE {
	requireExplicitPolicy	[0] SkipCerts OPTIONAL,
	inhibitPolicyMapping	[1] SkipCerts OPTIONAL }

Also the authorityInfoAccess OID is missing in the 88 module, it should be:

id-pe-authorityInfoAccess  OBJECT IDENTIFIER ::= { id-pe 1 }

More as I find 'em :-).

---

From: Russ Housley <[email-masked]>
Date: Fri, 18 Sep 1998 13:29:49 -0400

You found a minor editorial error in the document, but not an ASN.1
error.

For some reason, CertificatePolicies is defined here and where it should
be.

The two lines with '*' at the front should be deleted:

id-ce-policyConstraints
OBJECT IDENTIFIER ::=  { id-ce 36 }

*  CertificatePoliciesSyntax ::=

*
SEQUENCE SIZE (1..MAX) OF PolicyInformation

requireExplicitPolicy
[0] SkipCerts OPTIONAL,

inhibitPolicyMapping
[1] SkipCerts OPTIONAL }

SkipCerts ::= INTEGER (0..MAX)

Russ

At 03:47 PM 9/18/98 +1000, Dean Povey wrote:

>Research Scientist  | ph:  +61 7 3864
5120       |
www.cryptozilla.org/