Re: [Rescert] Draft of signed manifest design

[Stephen Kent <kent@bbn.com>]

At 11:53 AM -0400 5/30/07, Rob Austein wrote:
> Thanks, Steve.
>
> One point where my writeup apparently was not clear:
>
> >  The only differences I see are:
> >
> > 	- you list a file name and a hash of the file name, whereas I
> >          list URIs.
>
> My pseudocode was meant to indicate a hash of the file content, not a
> hash of the filename.  The intent was to provide some protection
> against replay of old copies of objects listed in the manifest.

OK, got it. That makes sense.

> I don't have an issue with filenames vs full URIs, I was assuming that
> the base portion of the URI was known and that I could thus cut the
> size of the manifest a bit by listing only the filenames, but I doubt
> it makes a great deal of difference either way.


I've revised the ASN.1 to make the file entries ordered pairs (file 
name and hash) and to include the file content hash alg ID. I kept 
multiple lists, grouping certs vs. CRLs vs. ROAs. (Your example was 
an undifferentiated list.) We probably need to establish a convention 
that the EE cert used to validate a manifest must be issued by the CA 
that signed the certs and CRLs that are in the enumerated files, and 
that the ROAs have to be signed by E certs that are issued by the 
same CA.

Also, I'm not sure we need the "MAX" qualifiers here.

Steve
------

Manifest ::=    SEQUENCE {
        version         INTEGER DEFAULT 0, -- to allow for future versions

        manifestNumber  INTEGER, -- to identify manifests issued 
between scheduled
				 -- issuance dates
        thisUpdate      GeneralizedTime, -- date and time this 
manifest was issued
        nextUpdate      GeneralizedTime,  -- date and time of next 
scheduled manifest
	fileHashAlg	OID -- algorithm used to generate file 
content hash values
        certfiles       SEQUENCE (SIZE (1..MAX)) OF FileAndHash,
                           -- list of one of more  cert file URIs and 
content hashes
        cRLfiles        SEQUENCE (SIZE (1..MAX)) OF FileAndHash,
                                  -- list of one or CRL file URIs and 
content hashes
	rOAfiles        SEQUENCE (SIZE (1..MAX)) OF FileAndHash OPTIONAL
                              -- list of one or more ROA file URIs 
and content hashes
                        }

FileAndHash ::=	SEQUENCE {
	file		IA5String -- file name
	hash		(SIZE (1..MAX)) BIT STRING
			}