Re: [Acme] ACME or EST?

"Joe Hildebrand (jhildebr)" <> Thu, 27 November 2014 16:30 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 155611A009E for <>; Thu, 27 Nov 2014 08:30:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 1uUq_v_f8qJh for <>; Thu, 27 Nov 2014 08:30:15 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 6DF7C1A007E for <>; Thu, 27 Nov 2014 08:30:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=1708; q=dns/txt; s=iport; t=1417105816; x=1418315416; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=zIqjSzHrt/aDFL/UN3ydNboJxdskW8AmZToiRZ0mm4E=; b=fJAWUMuEZ/fTPASjag78U56gNupoe+TR3dtVE3EiW4flAC2HhGdskL98 JfOTArChqb8z/98/AwTa6PkelW3/w2VLLFf1NXKXk2lQQp/BbCUydi2oY K3LPseSxEedjYUX0Lx2IkOev9bInXC/8gG3wdBAgjdYpbXTJbVwJ+B3vh g=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.07,470,1413244800"; d="scan'208";a="100715075"
Received: from ([]) by with ESMTP; 27 Nov 2014 16:30:15 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id sARGUEla003550 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 27 Nov 2014 16:30:14 GMT
Received: from ([]) by ([]) with mapi id 14.03.0195.001; Thu, 27 Nov 2014 10:30:14 -0600
From: "Joe Hildebrand (jhildebr)" <>
To: Randy Bush <>
Thread-Topic: [Acme] ACME or EST?
Thread-Index: AQHQCjxuSOTiIOtL1U66R1BPQr7fWZx0mY8A
Date: Thu, 27 Nov 2014 16:30:13 +0000
Message-ID: <>
References: <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/
x-originating-ip: []
Content-Type: text/plain; charset="utf-8"
Content-ID: <>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Cc: Richard Barnes <>, "" <>, Paul Hoffman <>
Subject: Re: [Acme] ACME or EST?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 27 Nov 2014 16:30:17 -0000

On 11/27/14, 12:19 PM, "Randy Bush" <> wrote:

>> I would also like to ensure that the operational model that is implied
>> by ACME is congruent enough with EST that an operator might be able to
>> use both in parallel - if possible.
>could you explain why?  transition?

There are at least a few pockets of folks who have made bets on EST, and 
I'd like to be able to get those people onboard with the overall approach. 
 Some of them may want to transition, and some of them may want to run a 
mix of protocols in order to not have to modify and re-test existing code 

>Tony Arcieri <> wrote:
>> ASN.1 is *not* "LANGSEC-friendly". JOSE comes a lot closer. For that 
>> alone, ASN.1 is inferior.
>are there pure LR parsers for jose?

JOSE is "just" JSON.  Here is my favorite small JSON parser:

That code makes it pretty clear what parser styles are possible.

JSON has plenty of other issues, but ease or clarity of parsing is not one 
of them.  For examples, look in RFC 7159 for interoperability problems.  
CBOR was developed (partially) to address most of those issues.

Joe Hildebrand