Subject: [lamps] Request for adopting draft-msahni-lamps-ocsp-nonce by the LAMPS WG (RFC6960: Issue with the OCSP Nonce extension)

From: Mohit Sahni <[email-masked]>
Date: Thu, 12 Mar 2020 09:53:35 -0700

Hi All,
I recently proposed a draft for properly defining the OCSP nonce extension,
specifically the length of the extension. Based on feedback I got from the
LAPMS WG members, I have updated the draft
(draft-msahni-lamps-ocsp-nonce-01) at
https://datatracker.ietf.org/doc/draft-msahni-lamps-ocsp-nonce/ .

I will request the WG members to kindly adopt the draft as an active
working group document and get it published.

Thanks
Mohit

---

From: Russ Housley <[email-masked]>
Date: Thu, 12 Mar 2020 14:40:50 -0400

Mohit:

I have two concerns with the document.

First, the Abstract and Introduction talk about "the updated format".  This is not really what is happening.  The nonce in RFC 6960 is an OCTET STRING, and the nonce with this update is still an OCTET STRING.  I think it would be better to describe this a clarification on the sizes of nonces that should be supported by an OCSP implementation.

Second, updates to an RFC usually have OLD and NEW text.  In this case the NEW text needs to be provided for three sections.

-- Section 4.4.1:  The NEW text is essentially Section 2.1 of your Internet-Draft.

-- Appendix B.1:  I do not see a specification in this module for Nonce.  It should be there.  So, your document should add a line:

      Nonce ::= OCTET STRING(SIZE(1..32))

-- Appendix B.2: The re-ocsp-nonce EXTENSION definition should be updated:

OLD:

re-ocsp-nonce EXTENSION ::= { SYNTAX OCTET STRING IDENTIFIED
                              BY id-pkix-ocsp-nonce }

NEW:

Nonce ::= OCTET STRING(SIZE(1..32))

re-ocsp-nonce EXTENSION ::= { SYNTAX Nonce IDENTIFIED
                              BY id-pkix-ocsp-nonce }

Russ

> On Mar 12, 2020, at 12:53 PM, Mohit Sahni <[email-masked]> wrote:
> 
> Hi All,
> I recently proposed a draft for properly defining the OCSP nonce extension, specifically the length of the extension. Based on feedback I got from the LAPMS WG members, I have updated the draft (draft-msahni-lamps-ocsp-nonce-01) at https://datatracker..ietf.org/doc/draft-msahni-lamps-ocsp-nonce/ <https://datatracker.ietf.org/doc/draft-msahni-lamps-ocsp-nonce/> . 
> 
> I will request the WG members to kindly adopt the draft as an active working group document and get it published.
> 
> Thanks
> Mohit

---

From: Mohit Sahni <[email-masked]>
Date: Thu, 12 Mar 2020 11:44:50 -0700

Hi Russ,
Thanks for the comments, I will make these changes and update the draft.

-Mohit

On Thu, Mar 12, 2020 at 11:40 AM Russ Housley <[email-masked]> wrote:

> First, the Abstract and Introduction talk about "the updated format".
> This is not really what is happening.  The nonce in RFC 6960 is an OCTET
> STRING, and the nonce with this update is still an OCTET STRING.  I think
> it would be better to describe this a clarification on the sizes of nonces
> that should be supported by an OCSP implementation.
>
> Second, updates to an RFC usually have OLD and NEW text.  In this case the
> NEW text needs to be provided for three sections.
>
> -- Appendix B.1:  I do not see a specification in this module for Nonce.
> It should be there.  So, your document should add a line:
>
> I recently proposed a draft for properly defining the OCSP nonce
> extension, specifically the length of the extension. Based on feedback I
> got from the LAPMS WG members, I have updated the draft
> https://datatracker..ietf.org/doc/draft-msahni-lamps-ocsp-nonce/
> <https://datatracker.ietf.org/doc/draft-msahni-lamps-ocsp-nonce/> .
>

---

From: Mohit Sahni <[email-masked]>
Date: Wed, 18 Mar 2020 15:35:31 -0700

Hi Russ,
I have updated the draft with the changes that you have suggested. Please
let me know if they are ok to move forward.

Thanks
Mohit

---

From: Russ Housley <[email-masked]>
Date: Thu, 19 Mar 2020 11:58:28 -0400

Mohit:

Section 5.1 does not look correct to me.  The OIDs are at the bottom of the ASN.1 module.  Only Nonce is not defined.

I would like to hear what other people think about adopting this document.  If we are going to adopt it, then this small thing can be fixed in the first WG version.

Russ

> On Mar 18, 2020, at 6:35 PM, Mohit Sahni <[email-masked]> wrote:
> 
> Hi Russ,
> I have updated the draft with the changes that you have suggested. Please let me know if they are ok to move forward. 
> 
> Thanks
> Mohit 
> 
> On Thu, Mar 12, 2020 at 11:40 AM Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Mohit:
> 
>> On Mar 12, 2020, at 12:53 PM, Mohit Sahni <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi All,
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 19 Mar 2020 16:04:15 +0000

The DER encoding doesn’t change, right?

Sure, this seems like a small simple thing to do, right in our charter.

One sentence “this assigns a maximum size to the Nonce extension” would be nice.

---

From: Mohit Sahni <[email-masked]>
Date: Thu, 19 Mar 2020 09:09:37 -0700

Hi Russ,
I added the OID's to give some context along with the definition of Nonce.
The reason being that the RFC 6960 only defines the OIDs of the extensions
and does not define any of the extensions, they assumed extensions are
defined in their respective sections in the RFC. If it's causing more
confusion, I will remove the OID information.

Thanks
Mohit

On Thu, Mar 19, 2020 at 8:58 AM Russ Housley <[email-masked]> wrote:

> Mohit:
>
> Section 5.1 does not look correct to me.  The OIDs are at the bottom of
> the ASN.1 module.  Only Nonce is not defined.
>
> I would like to hear what other people think about adopting this
> document.  If we are going to adopt it, then this small thing can be fixed
> in the first WG version.
>
> Russ
>
>> Second, updates to an RFC usually have OLD and NEW text.  In this case
>> the NEW text needs to be provided for three sections.
>>

---

From: Russ Housley <[email-masked]>
Date: Thu, 19 Mar 2020 13:15:10 -0400

> On Mar 19, 2020, at 12:04 PM, Salz, Rich <[email-masked]> wrote:
> 

Correct!
 
> One sentence “this assigns a maximum size to the Nonce extension” would be nice.

+1

Russ