Subject: [lamps] id-it-CertProfile in draft-ietf-lamps-cmp-updates

From: Lijun Liao <[email-masked]>
Date: Sun, 4 Jul 2021 22:58:17 +0200

As in the current draft version 11, the id-it-CertProfile is intended to be
added in the PKIHeader.generalInfo and specifies the CertProfile name. If
we have only one CertReqMsg entry or multiple entries but with the same
CertProfile, it is fine. However, if multiple CertReqMsg entries with
different CertProfiles are contained in one PKIMesasge, the solution in the
current draft version does not help.

So please consider the id-it-CertProfile as a CertReqMsg.regInfo.

Regards / Lijun

---

From: Lijun Liao <[email-masked]>
Date: Sun, 4 Jul 2021 23:31:52 +0200

For the PKIBody.p10cr, it-it-CertProfile should be placed
PKIHeader.generalInfo. So my suggestion is updated as follows:

So please allow the use of id-it-CertProfile as a PKIHeader.generalInfo to
specify the CertProfile for all single certfiicate requests, and as
CertReqMsg.regInfo for one single certificate request.

On Sun, Jul 4, 2021 at 10:58 PM Lijun Liao <[email-masked]> wrote:

> As in the current draft version 11, the id-it-CertProfile is intended to
> be added in the PKIHeader.generalInfo and specifies the CertProfile name.
> If we have only one CertReqMsg entry or multiple entries but with the same

-- 
Lijun Liao

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 5 Jul 2021 06:03:38 +0000

Lijun

Many tanks’ for your careful reading and proposal.
I see your point. Though, in the Lightweight CMP Profile we consider only one request per CMP message, this solution should be more general.
I prefer to have only one place to provide the certProfile for all three use cases, genm, CertReqMsg, and PKcs#10. Therefore, my proposal would be to use a PKIHeader.generalInfo in any cases, but to use sequence of UTF8String. In this case of more than one certProfile names the order is relevant.

      id-it-certProfile  OBJECT IDENTIFIER ::= {id-it 21}

         CertProfileValue ::= SEQUENCE OF UTF8String

Would this also solve your issue?
What do others think?

Hendrik

Von: Spasm <[email-masked]> Im Auftrag von Lijun Liao
Gesendet: Sonntag, 4. Juli 2021 23:32
An: LAMPS WG <[email-masked]>
Betreff: Re: [lamps] id-it-CertProfile in draft-ietf-lamps-cmp-updates

For the PKIBody.p10cr, it-it-CertProfile should be placed PKIHeader.generalInfo. So my suggestion is updated as follows:

So please allow the use of id-it-CertProfile as a PKIHeader.generalInfo to specify the CertProfile for all single certfiicate requests, and as CertReqMsg.regInfo for one single certificate request.

On Sun, Jul 4, 2021 at 10:58 PM Lijun Liao <[email-masked]<mailto:[email-masked]>> wrote:
As in the current draft version 11, the id-it-CertProfile is intended to be added in the PKIHeader.generalInfo and specifies the CertProfile name. If we have only one CertReqMsg entry or multiple entries but with the same CertProfile, it is fine. However, if multiple CertReqMsg entries with different CertProfiles are contained in one PKIMesasge, the solution in the current draft version does not help.

Regards / Lijun

--
Lijun Liao

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 5 Jul 2021 08:01:10 +0000

Thanks‘ Lijun for the feedback.

What do others think?

Hendrik

Von: Lijun Liao <[email-masked]>
Gesendet: Montag, 5. Juli 2021 09:03

Hi Hendrik,

your suggestion is fine for me.

Lijun
Brockhaus, Hendrik <[email-masked]<mailto:[email-masked]>> schrieb am Mo., 5. Juli 2021, 08:03:
Lijun

Hendrik

Von: Spasm <[email-masked]<mailto:[email-masked]>> Im Auftrag von Lijun Liao
Gesendet: Sonntag, 4. Juli 2021 23:32

Regards / Lijun

--
Lijun Liao