Subject: RE: Comments to PKIX AC profile

From: "Pawling, John" <[email-masked]>
Date: Tue, 17 Apr 2001 10:16:10 -0400

Stephen,

Thank you for your response.  I agree that you can just change "DEFINITIONS
EXPLICIT TAGS" to "DEFINITIONS IMPLICIT TAGS" in the current module.

===========================================
John Pawling, [email-masked]
Getronics Government Solutions, LLC
===========================================

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: Tuesday, April 17, 2001 9:13 AM
To: Pawling, John
Cc: ietf-pkix@imc. org (E-mail)
Subject: Re: Comments to PKIX AC profile

Hi John,

You're right about the EXPLICIT, but can't I just change the current 
module to (the 509-2000 compatible) IMPLICIT tagging rather than add a 
whole new module? (Maybe that's what you meant.)

Same thing for clearance: I'll make the change you suggest.

BTW: both of these break code, so anyone with code compliant to the 
-06 I-D, who has a reason not to make the change should yell about 
this now.

Regards,
Stephen (who just hates sneaky tagging:-)

"Pawling, John" wrote:
> 
> All,
> 
> In a separate message, Stephen Henson reported an incompatibility between
> the Attribute Certificate (AC) ASN.1 syntaxes defined in the PKIX AC
Profile
> for Authorization <draft-ietf-pkix-ac509prof-06.txt> and draft 2000 X.509
> Recommendation (4th Edition, Draft V7, 23 Feb 2001).
> The PKIX AC Profile, Appendix B, ASN.1 module includes "DEFINITIONS
EXPLICIT
> TAGS ::=", but the 2000 X.509 Recommendation ASN.1 module defining the AC
> syntax includes "DEFINITIONS IMPLICIT TAGS ::=".  Recommend that the PKIX
AC
> Profile should be changed so that the AC ASN.1 syntax is equivalent (i.e.
> produces the identical ASN.1 hex encoding) to that defined in the draft
2000
> X.509 Recommendation.  This could be accomplished by moving the AC syntax
> definition (and component syntax definitions) from the existing Appendix B
> module to a new ASN.1 module that includes "DEFINITIONS IMPLICIT TAGS
::=".
> That is the strategy used in the draft 2000 X.509 Recommendation.
> 
> Also, recommend that ac509prof-06 file should be changed so that the
> Clearance attribute ASN.1 syntax defined in Appendix B is equivalent to
that
> defined in X.501.  X.501 defines the Clearance attribute syntax using
> AUTOMATIC TAGS.  The Clearance attribute syntax in the PKIX AC profile
> should be changed as follows to be consistent with X.501:
> 
> Clearance ::= SEQUENCE
>   {
>       policyId
>           [0] OBJECT IDENTIFIER,
>       classList
>           [1] ClassList DEFAULT {unclassified},
>       securityCategories
>           [2] SET OF SecurityCategory OPTIONAL
>   }
> 
> ===========================================
> John Pawling, [email-masked]
> Getronics Government Solutions, LLC
> ===========================================

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com