Subject: Re: [pkix] Comments on draft-ietf-pkix-ocspagility-03.txt

From: Stefan Santesson <[email-masked]>
Date: Wed, 02 Dec 2009 14:16:20 +0100

I have submitted a new draft 04, which addresses all issues raised during WG
last call.

http://www.ietf.org/id/draft-ietf-pkix-ocspagility-04.txt

I need WG approval that the updated mandatory and optional algorithms for
OCSP are OK.

The current draft says MUST support RSA with SHA-1 and RSA with SHA 256 and
SHOULD DSA with SHA-1 (for backwards compatibility) and MAY support other
algorithms.

/Stefan

On 09-11-18 7:45 PM, "Stephen Kent" <[email-masked]> wrote:

> At 8:31 AM +0100 11/18/09, Stefan Santesson wrote:
>> Steve,
>> 
>> The situation in my opinion is that since algorithms other than the
>> mandatory to implement algorithms are allowed and since the client currently
>> has no mechanism to indicate it's algorithm preferences, there is always a
>> risk that a server choosing a non mandatory algorithm, generates a response
>> that the client may not support.
>> 
>> If you think a clarification is needed, then that is what I think should be
>> said.
>> 
>> /Stefan
>> 
> 
> I think this is a useful clarification.
> 
> Steve
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Sean Turner <[email-masked]>
Date: Wed, 02 Dec 2009 09:45:33 -0500

Stefan,

Algorithms look fine to me.  I might point to 
draft-ietf-pkix-sha2-dsa-ecdsa-10 instead of RFC 4055 for the alg.

I think some of the line breaks in the ASN.1 module are missing (changes 
make it slightly easier to read):

OLD:

    id-pkix-ocsp  FROM OCSP-2009  -- From OCSP [RFC2560]    {iso(1)
    identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp-02(48)}

      AlgorithmIdentifier{}, SIGNATURE-ALGORITHM  FROM
    AlgorithmInformation-2009 -- From [NEWASN]      {iso(1) identified-
    organization(3) dod(6) internet(1) security(5)      mechanisms(5)
    pkix(7) id-mod(0)      id-mod-algorithmInformation-02(58)}

      EXTENSION  FROM PKIX-CommonTypes-2009 -- From [NEWASN]      {iso(1)
    identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)};

      --  --  Add re-preferred-signature-algorithms to the set of
    extensions  --  for TBSRequest.requestExtensions  --
    id-pkix-ocsp  FROM OCSP-2009  -- From OCSP [RFC2560]    {iso(1)
    identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp-02(48)}

      AlgorithmIdentifier{}, SIGNATURE-ALGORITHM  FROM
    AlgorithmInformation-2009 -- From [NEWASN]      {iso(1) identified-
    organization(3) dod(6) internet(1) security(5)      mechanisms(5)
    pkix(7) id-mod(0)      id-mod-algorithmInformation-02(58)}

      EXTENSION  FROM PKIX-CommonTypes-2009 -- From [NEWASN]      {iso(1)
    identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)};

      --  --  Add re-preferred-signature-algorithms to the set of
    extensions  --  for TBSRequest.requestExtensions  --

      re-preferred-signature-algorithms EXTENSION ::= {      SYNTAX
    PreferredSignatureAlgorithm      IDENTIFIED BY id-pkix-ocsp-
    preferred-signature-algorithms  }

      id-pkix-ocsp-preferred-signature-algorithms OBJECT IDENTIFIER ::=
         { id-pkix-ocsp TBD }

      PreferredSignatureAlgorithms ::= SEQUENCE OF
               PreferredSignatureAlgorithm

      PreferredSignatureAlgorithm ::= SEQUENCE {    sigIdentifier
    AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}},    certIdentifier
    AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}} OPTIONAL  }

NEW:

    id-pkix-ocsp
      FROM OCSP-2009  -- From OCSP [RFC2560]
       { iso(1) identified-organization(3) dod(6) internet(1) security(5)
         mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp-02(48) }

    AlgorithmIdentifier{}, SIGNATURE-ALGORITHM
      FROM AlgorithmInformation-2009 -- From [NEWASN]
        { iso(1) identified-organization(3) dod(6) internet(1)
          security(5) mechanisms(5) pkix(7) id-mod(0)
          id-mod-algorithmInformation-02(58) }

    EXTENSION
      FROM PKIX-CommonTypes-2009 -- From [NEWASN]
       { iso(1) identified-organization(3) dod(6) internet(1) security(5)
         mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)} ;

     --
     --  Add re-preferred-signature-algorithms to the set of extensions
     --  for TBSRequest.requestExtensions
     --

    re-preferred-signature-algorithms EXTENSION ::= {
       SYNTAX PreferredSignatureAlgorithm
       IDENTIFIED BY id-pkix-ocsp-preferred-signature-algorithms  }

    id-pkix-ocsp-preferred-signature-algorithms OBJECT IDENTIFIER ::=
       { id-pkix-ocsp TBD }

    PreferredSignatureAlgorithms ::= SEQUENCE OF
                                       PreferredSignatureAlgorithm

    PreferredSignatureAlgorithm ::= SEQUENCE {
      sigIdentifier  AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}},
      certIdentifier AlgorithmIdentifier{SIGNATURE-ALGORITHM, {...}}
                       OPTIONAL  }

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 02 Dec 2009 16:25:10 +0100

Sean,

Thanks. I can update the reference once the new draft is published. I think
this will be catched by the RFC editor in any case.

Thanks for spotting the ASN.1. That was due to a missed nroff directive
(.nf)

I have fixed it and resubmitted:

http://www.ietf.org/id/draft-ietf-pkix-ocspagility-05.txt

/Stefan

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 03 Dec 2009 21:57:36 +0100

Sean,

> draft-ietf-pkix-sha2-dsa-ecdsa-10 instead of RFC 4055 for the alg.

I looked closer to this. It does not appear as any of the algorithm OIDs
that are relevant for the ocspagility draft are to be found in
draft-ietf-pkix-sha2-dsa-ecdsa.

I think the references are good as they are.

/Stefan

---

From: Sean Turner <[email-masked]>
Date: Thu, 03 Dec 2009 16:13:23 -0500

> I think the references are good as they are.

My bad, there are no RSA algs in sha2-dsa-ecdsa they're in 4055.

spt