Subject: [pkix] Why import PKCS-10 in PKIXCMP-2009?

From: Ed Day <[email-masked]>
Date: Sun, 18 Jul 2010 08:04:39 -0400

In the new PKIX 2009 ASN.1 modules, an import of PKCS-10 is done in
PKIXCMP-2009 with this comment:

 CertificationRequest
 FROM PKCS-10
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkcs10-2009(69)}
 -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
 -- tags).  Alternatively, implementers may directly include
 -- the [PKCS10] syntax in this module
 ;

That's fine, but if you check the PKCS-10 module in RFC 2986, you will
see that it contains imports to items in X.509 modules such as
InformationFramework and AuthenticationFramework.  So now someone who
would like to use an automated tool for dealing with these new specs
would need to search for and pull in modules from the X.509 framework.
 This is unfortunate since it looks like a great deal of care was
taken to make these specifications self-contained and it is only in
this one place that modules outside the new specifications are
referenced.

Regards,

Ed Day
Objective Systems, Inc.
http://www.obj-sys.com