Re: [Jeffrey Hutzelman] LAST CALL - Public Key Cryptography for Initial Authentication in Kerberos

[Steven Legg <steven.legg@xxxxxxxxxxx>]

Love, et al,

Love Hörnquist Åstrand wrote:
> Peter Sylvester <Peter.Sylvester@xxxxxxxxxx> writes:
>
>
> > The first one can be replaced by
> >
> >        subjectName            [0] IMPLICIT OCTET STRING OPTIONAL CONTAINING Name

The correct syntax here is:

         subjectName   [0] IMPLICIT OCTET STRING (CONTAINING Name) OPTIONAL

> Lets take another example:
>
>        PA-PK-AS-REQ ::= SEQUENCE {
>           signedAuthPack          [0] IMPLICIT OCTET STRING,
>                    -- Contains a CMS type ContentInfo encoded
>                    -- according to [RFC3852].
>                    -- The contentType field of the type ContentInfo
>                    -- is id-signedData (1.2.840.113549.1.7.2),
>                    -- and the content field is a SignedData.
>
> With you syntax this should be
>
> 	signedAuthPack IMPLICIT OCTET STRING OPTIONAL CONTAINING ContentInfo
>
> Now, ContentInfo in a CMS type, and is allowed to be encoded in BER.
> Kerberos datatypes uses DER.
>
> How is that expressed in a formal way ?

signedAuthPack IMPLICIT OCTET STRING
                  (CONTAINING ContentInfo
                   ENCODED BY {joint-iso-itu-t asn(1) ber-derived(2) distinguished-encoding(1)})
                  OPTIONAL

The OID after the "ENCODED BY" is the OID that identifies DER.

> Just saying IMPORT and CONTANING and expect the right thing to happen when
> given to a compiler seems very naive.

There's a better chance that the compiler can do something useful than if
the requirements are expressed informally as a comment.

Regards,
Steven

> Love