Subject: [TSP/RFC3161] PKIFailureInfo values

From: Ricardo Barroso <[email-masked]>
Date: Tue, 05 Nov 2002 14:25:01 +0000

Hello!

RFC 3161 (TSP) says in 2.4.2:

   "... When the TimeStampToken is not present, the failInfo indicates the
   reason why the time-stamp request was rejected and may be one of the
   following values.

PKIFailureInfo ::= BIT STRING {
   badAlg               (0),
     -- unrecognized or unsupported Algorithm Identifier
   badRequest           (2),
     -- transaction not permitted or supported
   badDataFormat        (5),
     -- the data submitted has the wrong format
   timeNotAvailable    (14),
     -- the TSA's time source is not available
   unacceptedPolicy    (15),
     -- the requested TSA policy is not supported by the TSA
   unacceptedExtension (16),
     -- the requested extension is not supported by the TSA
    addInfoNotAvailable (17)
      -- the additional information requested could not be understood
      -- or is not available
    systemFailure       (25)
      -- the request cannot be handled due to system failure  }

   These are the only values of PKIFailureInfo that SHALL be supported.

   Compliant servers SHOULD NOT produce any other values. Compliant
   clients MUST generate an error if values it does not understand are
   present. ...".

Since a BIT STRING can hold several bit values that can be either 1 or 0,
is it supposed that a BIT STRING representing a PKIFailureInfo MUST has
ONLY one bit (correspondent to one of the defined possible values) or can
a PKIFailuereInfo has more than one bit with value 1 wich means that it
can indicates more than one valid failure reasons?

Using another words, in:

   "When the TimeStampToken is not present, the failInfo indicates the
   reason why the time-stamp request was rejected and *may be one* of the
   following values."

"may be one" doesn't implies that compliant servers can't generate
PKIFailusInfo's with more than one valid value, am I right?

Thanks in advance,
Ricardo Barroso

MULTICERT S.A.
www.multicert.com <http://www.multicert.com>

---

From: Andrew Fan <[email-masked]>
Date: Wed, 06 Nov 2002 18:01:16 +0800

> can indicates more than one valid failure reasons?
Indeed, from the Encoding technology of ASN.1, PKIFailureInfo must have
25 bits, if bit 0 set to 1, badAlg is one reason of this failure, and so on.

> PKIFailusInfo's with more than one valid value, am I right?

"may be one of the ..." will be more understandable.

---

From: Ricardo Barroso <[email-masked]>
Date: Wed, 06 Nov 2002 15:24:38 +0000

Thanks you Peter and Andrew!

Peter, I would like to suggest you(if you haven't done it already) that
you or
someone else of the IETF take a note about that ambiguous/doubtful point
since I think it would be useful to clarify that doubt in a possible new
future
draft/RFC (e.g. draft-ietf-pkix-rfc3161bis-00
<http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc3161bis-00.txt>).
Because with RFC 3161 it's possible that exist two compliant systems
which can't
interoperate properly in some situations because one accepts that
PKIFailueInfo
contains more than one bit with value one (1) and the other not!

Best regards,
Ricardo Barroso