Subject: [lamps] I-D Action: draft-ietf-lamps-cmp-updates-15.txt

From: [email-masked]
Date: Fri, 17 Dec 2021 07:56:16 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF.

        Title           : Certificate Management Protocol (CMP) Updates
        Authors         : Hendrik Brockhaus
                          David von Oheimb
                          John Gray
	Filename        : draft-ietf-lamps-cmp-updates-15.txt
	Pages           : 69
	Date            : 2021-12-17

Abstract:
   This document contains a set of updates to the syntax and transfer of
   Certificate Management Protocol (CMP) version 2.  This document
   updates RFC 4210, RFC 5912, and RFC 6712.

   The aspects of CMP updated in this document are using EnvelopedData
   instead of EncryptedValue, clarifying the handling of p10cr messages,
   improving the crypto agility, as well as adding new general message
   types, extended key usages to identify certificates for use with CMP,
   and '.well-known' HTTP path segments.

   To properly differentiate the support of EnvelopedData instead of
   EncryptedValue, the CMP version 3 is introduced in case a transaction
   is supposed to use EnvelopedData.

   CMP version 3 is introduced to enable signaling support of
   EnvelopedData instead of EncryptedValue and signaling the use of an
   explicit hash AlgorithmIdentifier in certConf messages, as far as
   needed.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-lamps-cmp-updates/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-lamps-cmp-updates-15.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-cmp-updates-15

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 17 Dec 2021 16:00:27 +0000

This update is supposed to handle all comments revived during WG last call.

   From version 14 -> 15:
   *  Updated Section 2.16 clarifying the usage of CRLSource (see thread
      "CRL update retrieval - WG Last Call for draft-ietf-lamps-cmp-
      updates-14 and draft-ietf-lamps-lightweight-cmp-profile-08")
   *  Updated Section 2.22 adding further references regarding random
      number generation (see thread "CMP draft WGLC: measuring entropy,
      CA certificates")
   *  Fixed some nits

Hendrik

> Von: Spasm <[email-masked]> Im Auftrag von internet-
> [email-masked]
> 
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatr
> acker.ietf.org%2Fdoc%2Fdraft-ietf-lamps-cmp-
> updates%2F&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7
> C2739a568de7b49770fc108d9c175eed7%7C38ae3bcd95794fd4addab42e1495
> d55a%7C1%7C0%7C637753534530099485%7CUnknown%7CTWFpbGZsb3d8ey
> JWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7
> C3000&amp;sdata=0hawLk56soKd17ulZV%2Ff10rwqWEkFJZS6Dq621piHig%3D
> &amp;reserved=0
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Farchive%2Fid%2Fdraft-ietf-lamps-cmp-updates-
> 15.html&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7C273
> 9a568de7b49770fc108d9c175eed7%7C38ae3bcd95794fd4addab42e1495d55a
> %7C1%7C0%7C637753534530099485%7CUnknown%7CTWFpbGZsb3d8eyJWIj
> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C30
> 00&amp;sdata=4uYUgThAUINNElt%2FqiMo8njoS%2BGGCDcn5eXWXeNvv4w
> %3D&amp;reserved=0
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-lamps-cmp-updates-
> 15&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7C2739a568
> de7b49770fc108d9c175eed7%7C38ae3bcd95794fd4addab42e1495d55a%7C1
> %7C0%7C637753534530099485%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC
> 4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&a
> mp;sdata=y21bkP%2FkqiOxgIAqjPWRZpco3%2FKVpcJOoqs%2FaBUJvW4%3D&
> amp;reserved=0
> 
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.br
> ockhaus%40siemens.com%7C2739a568de7b49770fc108d9c175eed7%7C38ae3
> bcd95794fd4addab42e1495d55a%7C1%7C0%7C637753534530099485%7CUnk
> nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1
> haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=nLsp4PZh3fxcrpocY2tvUnimKl8
> PvEeZLXbkmMIxj1I%3D&amp;reserved=0

---

From: Russ Housley <[email-masked]>
Date: Fri, 17 Dec 2021 11:06:12 -0500

Dear LAMPS WG:

Please speak in the next few days if the updates do not address your WG Last Call comments.  If no one speaks up, then we will forward this document to the IESG.

I will begin the shepherd writeup in preparation for success.

Russ

> On Dec 17, 2021, at 11:00 AM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Russ Housley <[email-masked]>
Date: Fri, 17 Dec 2021 11:52:00 -0500

I just looked at the IDnits output for this document.  Authors, please look at this warning:

  -- The document seems to lack a disclaimer for pre-RFC5378 work, but may
     have content which was first submitted before 10 November 2008.  If you
     have contacted all the original authors and they are all willing to grant
     the BCP78 rights to the IETF Trust, then this is fine, and you can ignore
     this comment.  If not, you may need to add the pre-RFC5378 disclaimer. 
     (See the Legal Provisions document at
     https://trustee.ietf.org/license-info for more information.)
Russ

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 17 Dec 2021 17:17:09 +0000

Russ

As Jim is not with us anymore, I will not get the approval from all of the authors. Therefore, I guess I need to add the pre-RFC5378 disclaimer.
If the consent of one of the authors per updated RFCs is sufficient, I could ask Paul Hoffman regarding RFC 5912.

Hendrik

> Von: Russ Housley <[email-masked]>
> Gesendet: Freitag, 17. Dezember 2021 17:52
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftruste
> e.ietf.org%2Flicense-
> info&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7Cbe1e11f
> 5238d468bcf9008d9c17d8d9c%7C38ae3bcd95794fd4addab42e1495d55a%7C1
> %7C0%7C637753567875482343%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC
> mp;sdata=M1P8BvBYLqcPEfKBjqnhMbblFQBhIA%2FhX0GUHAuWL8U%3D&am
> p;reserved=0 for more information.) Russ
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> >>
> .i%2F&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7Cbe1e1
> 1f523
> >>
> 8d468bcf9008d9c17d8d9c%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7
> C0%7C6
> >>
> 37753567875482343%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMD
> AiLCJQIjo
> >>
> iV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=sDzcRkKne
> KRo
> >> 9fNuErrfI7zkgtVE%2FaHgKGM5vgEklaQ%3D&amp;reserved=0
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> >>
> .i%2F&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7Cbe1e1
> 1f523
> >>
> 8d468bcf9008d9c17d8d9c%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7
> C0%7C6
> >>
> 37753567875482343%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMD
> AiLCJQIjo
> >>
> iV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=sDzcRkKne
> KRo
> >> 9fNuErrfI7zkgtVE%2FaHgKGM5vgEklaQ%3D&amp;reserved=0
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> >>
> .i%2F&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7Cbe1e1
> 1f523
> >>
> 8d468bcf9008d9c17d8d9c%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7
> C0%7C6
> >>
> 37753567875482343%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMD
> AiLCJQIjo
> >>
> iV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=sDzcRkKne
> KRo
> >> 9fNuErrfI7zkgtVE%2FaHgKGM5vgEklaQ%3D&amp;reserved=0
> >>
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> >
> ietf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.br
> ock
> >
> haus%40siemens.com%7Cbe1e11f5238d468bcf9008d9c17d8d9c%7C38ae3bcd
> 95794f
> >
> d4addab42e1495d55a%7C1%7C0%7C637753567875482343%7CUnknown%7C
> TWFpbGZsb3
> >
> d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3
> D%7
> >
> C3000&amp;sdata=Uxkty3HPt5FsRaSvBOo5X4Cywq9a1eIRu6vAhrJdFoo%3D&
> amp;res
> > erved=0

---

From: Russ Housley <[email-masked]>
Date: Fri, 17 Dec 2021 12:24:38 -0500

One way to resolve that point is to change the document to say that the ASN.1 module in this document should be used instead of the one in RFC 5912.  That would resolve the need to reach Jim.  I miss him greatly ...

Russ

> On Dec 17, 2021, at 12:17 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
>

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 17 Dec 2021 17:46:07 +0000

I just checked the release dates of the RFCs as the warning only refers to RFCs released before 10 November 2008.
RFC 4210: September 2005
RFC 5912: June 2010
RFC 6712: September 2012

Therefore, it should be sufficient to get the consent from the authors from RFC 4210. These are Carlisle Adams, Stephen Farrell, Tomi Kause,  and Tero Mononen. I only met Stephen at the Singapore meeting. But I will try to contact all of them.

Hendrik

> Gesendet: Freitag, 17. Dezember 2021 18:25
> 
> One way to resolve that point is to change the document to say that the
> ASN.1 module in this document should be used instead of the one in RFC
> 5912.  That would resolve the need to reach Jim.  I miss him greatly ...
> 
> Russ
> 
> > As Jim is not with us anymore, I will not get the approval from all of the
> authors. Therefore, I guess I need to add the pre-RFC5378 disclaimer.
> >>> This update is supposed to handle all comments revived during WG
> >>> last
> >> call.
> >>>
> >>>  From version 14 -> 15:
> >>>>  This document contains a set of updates to the syntax and transfer
> >>>> of  Certificate Management Protocol (CMP) version 2.  This document
> >>>>  The aspects of CMP updated in this document are using
> >>>> EnvelopedData  instead of EncryptedValue, clarifying the handling
> >>>> of p10cr messages,  improving the crypto agility, as well as adding
> >>>> new general message  types, extended key usages to identify
> >>>> certificates for use with CMP,  and '.well-known' HTTP path segments.
> >>>>
> >>>> EncryptedValue, the CMP version 3 is introduced in case a
> >>>> transaction  is supposed to use EnvelopedData.
> >>>>
> >>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd
> >>>> at
> >>>> atr

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 17 Dec 2021 18:11:04 +0000

Dear all

May be you noticed that there is some profiling and updating work going on regarding CMP.
The documents are located in the LAMPS working group and passed WG last call already.
Russ asked me to get in touch with you and ask you for consent to RFC5378 and grant the respective rights to IETF Trust.

If one of the email addresses is wrong and you have a more current on, feel free to forward my email.

Many thanks and best regards,
Hendrik

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 17 Dec 2021 20:07:33 +0000

On 17/12/2021 18:11, Brockhaus, Hendrik wrote:
> Russ asked me to get in touch with you and ask you for consent to
> RFC5378 and grant the respective rights to IETF Trust.
Sure.

S.

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 20 Dec 2021 07:22:18 +0000

Thanks to Stephen for his swift reply.

Does anyone has a current email-address for Tero Mononen. The email address used doe not exist anymore?

Hendrik

> Von: Brockhaus, Hendrik (T RDA CST SEA-DE)
> Gesendet: Freitag, 17. Dezember 2021 19:11
> 
> Dear all
> 
> Russ asked me to get in touch with you and ask you for consent to RFC5378
> and grant the respective rights to IETF Trust.
> 
> EnvelopedData

---

From: Carlisle Adams <[email-masked]>
Date: Mon, 20 Dec 2021 15:33:15 +0000

Hi all,

Along with Stephen, I am fine with RFC5378 and granting the respective rights to IETF Trust.

No, I do not have any other address for Tero Mononen.

Carlisle.

-----Original Message-----
From: Brockhaus, Hendrik <[email-masked]> 
Sent: December-20-21 2:22 AM
To: Carlisle Adams <[email-masked]>; Stephen Farrell <[email-masked]>; [email-masked]; [email-masked]
Cc: [email-masked]; Russ Housley <[email-masked]>; [email-masked]
Subject: AW: [lamps] I-D Action: draft-ietf-lamps-cmp-updates-15.txt

Attention : courriel externe | external email

Hendrik

> >   -- The document seems to lack a disclaimer for pre-RFC5378 work, 
> > but
> may
> >      have content which was first submitted before 10 November 2008.  
> > If
> you
> > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftr
> > us
> > te
> > e.ietf.org%2Flicense-
> >
> > >> A New Internet-Draft is available from the on-line 
> > >> Internet-Drafts
> > directories.

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Mon, 20 Dec 2021 16:04:08 +0000

Carlisle, thank you for the feedback and approval.

Hendrik

> Von: Carlisle Adams <[email-masked]>
> Gesendet: Montag, 20. Dezember 2021 16:33
> 
> Hi all,
> 
> To: Carlisle Adams <[email-masked]>; Stephen Farrell
> <[email-masked]>; [email-masked]; [email-masked]
> of
> > > >> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2
> > > >> 52
> > > >> Fd
> > > >> at
> > > >> atr

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 21 Dec 2021 15:58:35 +0000

Russ

I got approval from Stephen and Carlisle. I did not get any feedback from Tomi so far.
I do not have any current email address from Tero.

In addition I recognized that RFC 6712 released 2012 and updating RFC 4210 also contains the pre5378Trust200902 disclaimer.
Therefore, I propose adding this text also to CMP Algorithms and CMP Updates.

Hendrik

> Von: Spasm <[email-masked]> Im Auftrag von Brockhaus, Hendrik
> Gesendet: Montag, 20. Dezember 2021 17:04
> 
> > > > >>   EnvelopedData instead of EncryptedValue and signaling the use
> > > > >> of
> > an
> > > > >> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F
> > > > >> %252
> > > > >> 52
> > > > >> Fd
> > > > >> at
> > > > >> atr
> ockhaus%40siemens.com%7C6d3cee2e6eb8410ebc0808d9c3d268ce%7C38ae
> 3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637756130739736022%7CUn
> known%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik
> 1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=VO%2BdjKGU%2Blbn60adihK
> MT4RZ2%2BdPklArGswjfTfTomw%3D&amp;reserved=0

---

From: Russ Housley <[email-masked]>
Date: Tue, 21 Dec 2021 11:17:46 -0500

Hendrik:

Okay.  That will get the job done.

Russ

> On Dec 21, 2021, at 10:58 AM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
>