Subject: [pkix] Question about ASN.1 for RFC 2560 - OCSP

From: "Jim Schaad" <[email-masked]>
Date: Mon, 10 May 2010 21:13:36 -0700

In the process of doing an Auth48 review I ended up with the following issue
on the ASN.1 for RFC 2560 and I am not positive how it should really be
addressed.  My inclination is to ignore it and remove the comment until an
update comes out that address it but I think the issue should be logged.

The ASN.1 has the following:

   CertStatus ::= CHOICE {
       good        [0]     IMPLICIT NULL,
       revoked     [1]     IMPLICIT RevokedInfo,
       unknown     [2]     IMPLICIT UnknownInfo }

   UnknownInfo ::= NULL -- this can be replaced with an enumeration

The problem is that the comment is not true if this is supposed to be
decoded.  The ASN.1 for an enumeration and the ASN.1 for a NULL are
completely incompatible.  Either the comment needs to be removed from the
document or it needs to be changed to be either an integer or an enumeration
(neither of which would need a set of values defined) so that the
encode/decode can be correctly performed.

Note that there is additional ASN.1 between the choice and the definition of
UnknownInfo so the comment would not be applicable to the choice.

I find nothing in the supporting text that indicates that this field could
ever become an enumeration.

Jim

---

From: Russ Housley <[email-masked]>
Date: Tue, 11 May 2010 16:39:29 -0400

Seems to be that you should enter an errata that removes the comment.

Russ

On 5/11/2010 12:13 AM, Jim Schaad wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 11 May 2010 22:19:54 +0200

I agree

/Stefan

---

From: Tom Gindin <[email-masked]>
Date: Wed, 12 May 2010 12:46:54 -0400

If anybody were to replace "UnknownInfo" by an enumeration 
(presumably giving the reason why the server doesn't know) in a later 
edition, they'd need to define another entry in the CertStatus choice. 
You'd have something like another line called Indeterminate (with the 
Integer or Enum tag) and the reason why it can't be determined.  I'm not 
sure that it's worth relaying such things to an OCSP client in any case.

                Tom Gindin

From:
Stefan Santesson <[email-masked]>
To:
Russ Housley <[email-masked]>, <[email-masked]>
Date:
05/11/2010 06:21 PM
Subject:
Re: [pkix] Question about ASN.1 for RFC 2560 - OCSP
Sent by:
[email-masked]

I agree

/Stefan

---

From: Michael Myers <[email-masked]>
Date: Wed, 12 May 2010 11:53:55 -0700

I prefer we choose to delete the comment.

Mike