Subject: RE: Feedback from PKINIT Review...

From: "Eric Rosenfeld" <[email-masked]>
Date: Wed, 31 Mar 2004 08:57:52 -0700

-----Original Message-----
From: Brian Tung [mailto:[email-masked]] 
Sent: Tuesday, March 30, 2004 7:57 PM
To: Eric Rosenfeld
Cc: [email-masked]
Subject: Re: Feedback from PKINIT Review...

Eric Rosenfeld wrote:
> 2) ASN.1 - We found several problems with the ASN.1. We think it would
> be a good idea to have a complete ASN.1 module in an Appendix. The
> problems that we found so far:
> 
> 	- The latest draft imported the wrong ASN.1 module for PKIX. It
> imported PKIX1Explicit93, but RFC3280 (and RFC2459 before it) use
> PKIX1Explicit88.
> 	- Incorrect Import statements, and multiple Imports for the same
> module. A single module in an appendix would allow for a single import
> for each module.
> 	- Definition of subjectAltName was incorrect. It used
> OTHER-NAME, which was in RFC2459, but defined differently in RFC3280
> because of incompatibilities between 93 syntax and 88 syntax. We had
to
> perform major surgery here.

The problem is that PKIX1Explicit88 (and OTHER-NAME within it) does not
use the object information model, which (I seem to recall from our
hallway meeting in Minn) we wanted to use in lieu of AnotherName, which
uses EXPLICIT ANY DEFINED BY type-id, which I thought we did not want to
use.  Did I misremember?  (It wouldn't be the first time.)

[ERIC] I don't remember that specific conversation. Can you explain why
we don't want AnotherName?

I guess the question is how can we use 93 when RFC3280 and RFC2459 use
88 (unless I am mistaken), and RFC3280 has changed because of this
problem (the ASN.1 module contains a specific comment that OTHER-NAME
has been replaced by otherName because 88 does not support
TYPE-IDENTIFIER. Ultimately, will the IESG approve an RFC that does
deviates from RFC3280, and the ASN.1 module within it?

> We should be finished with our review tomorrow, and will hand the
> results back to Brian Tung then. We will have additional comments that
> need to be addressed. However, given the importance of the issues
raised
> above, it would be good if we could get some discussion and resolution
> before posting draft 19.

Jeff, I agree that we should post it as soon as I look at it.

[ERIC] We'll send our comments to Brian by the end of today. I just
wanted to make everyone aware of the technical issues that we
encountered given that we were shooting to make draft 19 the last-call
draft.

Brian Tung <[email-masked]>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 31 Mar 2004 13:04:22 -0500

>>>>> "Eric" == Eric Rosenfeld <[email-masked]> writes:

    Eric> I guess the question is how can we use 93 when RFC3280 and
    Eric> RFC2459 use 88 (unless I am mistaken), and RFC3280 has
    Eric> changed because of this problem (the ASN.1 module contains a
    Eric> specific comment that OTHER-NAME has been replaced by
    Eric> otherName because 88 does not support
    Eric> TYPE-IDENTIFIER. Ultimately, will the IESG approve an RFC
    Eric> that does deviates from RFC3280, and the ASN.1 module within
    Eric> it?

I believe the answer is no based on something Russ said at a working
group chairs gathering, but asking him explicitly is the best way to
get an answer.