Subject: [pkix] Question about RFC 3125

From: Russ Housley <[email-masked]>
Date: Tue, 12 Nov 2019 10:29:03 -0500

Section 3.4 of RFC 3125 talks about Commitment Rules, and it specifies the following structure:

   CommitmentType ::= SEQUENCE {
        identifier                      CommitmentTypeIdentifier,
        fieldOfApplication      [0] FieldOfApplication OPTIONAL,
        semantics               [1] DirectoryString OPTIONAL }

However, CommitmentTypeIdentifier is never defined.  Is it an object identifier?

Can anyone point to a public signature policy that uses the SignaturePolicy defined in RFC 3125?

Russ

---

From: Denis <[email-masked]>
Date: Tue, 12 Nov 2019 17:02:31 +0100

Hello Russ,

I wonder why you have an interest, today, in a document that was written 
... 18 years ago.

FYI, ETSI TC ESI sent for a public review until the August 31, 2019 a 
document about signature policies:

  * draft TS 119 172-2: Signature Policies; Part 2: XML format for
    signature policies, and
  * draft TS 119 172-3: Signature Policies; Part 3: ASN.1 format for
    signature policies

These documents are still downloadable from: 
http://docbox.etsi.org/ESI/Open/Latest_Drafts/

More specifically from :

  * https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-2v003-public.pdf

and

  * https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-3v003-public.pdf

I prepared and sent 43 comments on Part 2 only, since IMO, it was not 
necessary anymore to define a signature policy using ASN.1.

Now, to answer your question, the intent in RFC 3125 was to have an OID, 
in order to have an unambiguous meaning, whatever the local language
of the signer and of the verifier would be.

Denis

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Sean Turner <[email-masked]>
Date: Tue, 12 Nov 2019 11:03:41 -0500

I mean it has to be an OID - right?

spt

> On Nov 12, 2019, at 10:29, Russ Housley <[email-masked]> wrote:
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 12 Nov 2019 17:15:01 +0100

It's defined as OID in the referenced document ETSI TS101733
https://www.etsi.org/deliver/etsi_ts/101700_101799/101733/02.02.01_60/ts_101733v020201p.pdf

It's also defined in the new version that obsoletes 101733 (ETSI EN 319 122-1)
https://www.etsi.org/deliver/etsi_en/319100_319199/31912201/01.01.01_60/en_31912201v010101p.pdf

Stefan Santesson 

On 2019-11-12, 17:03, "pkix on behalf of Sean Turner" <[email-masked] on behalf of [email-masked]> wrote:

    spt

---

From: Russ Housley <[email-masked]>
Date: Tue, 12 Nov 2019 17:00:49 -0500

Denis:

I understand the age of the document.  I notice that RFC 3126 was replaced by a newer version, but this one was not.

Russ

> On Nov 12, 2019, at 11:02 AM, Denis <[email-masked]> wrote:
> 
> Hello Russ,
> 
> I wonder why you have an interest, today, in a document that was written ... 18 years ago.
> 
> FYI, ETSI TC ESI sent for a public review until the August 31, 2019 a document about signature policies:
> draft TS 119 172-2: Signature Policies; Part 2: XML format for signature policies, and
> draft TS 119 172-3: Signature Policies; Part 3: ASN.1 format for signature policies
> These documents are still downloadable from: http://docbox.etsi.org/ESI/Open/Latest_Drafts/ <http://docbox.etsi.org/ESI/Open/Latest_Drafts/>
> 
> More specifically from :
> https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-2v003-public.pdf <https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-2v003-public.pdf>
> and 
> https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-3v003-public.pdf <https://docbox.etsi.org/ESI/Open/Latest_Drafts/ESI-0019172-3v003-public.pdf>
> 
> I prepared and sent 43 comments on Part 2 only, since IMO, it was not necessary anymore to define a signature policy using ASN.1.
> 
> Now, to answer your question, the intent in RFC 3125 was to have an OID, in order to have an unambiguous meaning, whatever the local language 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/pkix <https://www.ietf.org/mailman/listinfo/pkix>
>