[Cbor] Robert Wilton's Discuss on draft-ietf-cbor-tags-oid-06: (with DISCUSS and COMMENT)

[Robert Wilton via Datatracker <[e-mail]>]

Robert Wilton has entered the following ballot position for
draft-ietf-cbor-tags-oid-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cbor-tags-oid/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Hi,

Hopefully not tricky to discuss/resolve, sorry for posting it close to the
telechat!

I would like to please see some more clarity or guidance about when TAG TBD112
should be used, given that there are two possible encodings of absolute OIDs
below "1.3.6.1.4.1".

Specifically, the questions that I have, that probably need to be clarified are:
 - is a CBOR encoder allowed to optimize a TBD110 tag into a TBD112 tag?
 - Should CBOR decoder clients always expect to be able to handle both TBD110
 and TBD112 tags? - Or, it the decision over whether to use TBD110 or TBD112
 down to the application and the application needs to agree which is use.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I found this document to be interesting because I knew from the title that it
was going to only be 4 pages long and say that OIDs are obviously encoded as a
tagged array, hence I was surprised to see that was not the solution and it
uses BER encoded OIDs instead.

The document explains, and I think that I understand why this has been done,
but I question whether the title of the document and name of the tags is right.
 Is it really a CBOR representation of OIDs, or is it actually a CBOR
representation of BER encoded OIDs?  I.e., it is plausible that there would
ever be a requirement for non BER encoded OIDs.  E.g., I'm not an ASN.1 expert,
but say if somewhat wanted to do a CBOR encoding of ASN.1, then it is not
obvious to me that they would use a BER encoding for OIDs.  Hence the
suggestion is to make the title, abstract, and name of the tags clear that it
is about the CBOR encoding or BER encoded OIDs.

In the introduction:
   Since the semantics of absolute and relative object identifiers
   differ, this specification defines two tags, collectively called the
   "OID tags" here:

I presume that this should be three tags?

In section 4.1.  Tag Factoring Example: X.500 Distinguished Name:

The diagram uses a mix of single letters (e.g. c for country), and a full name
"street".  Is this how the X.500 attributes are defined?  Otherwise it might be
clearer to always use their full names.

    The country and street RDNs are single-valued. The second and fourth RDNs
    are multi-valued.

Perhaps:  "The country (first) and street (third) RDNs are single-valued. The
second and fourth RDNs are multi-valued."

    h'550407': "Los Angeles", h'550408': "CA",

I think that the example would be more clear by splitting the city and county
onto separate lines.

Finally, the document contains these two sentences that seem to somewhat
conflict with each other:

"While these sequences can easily be represented in CBOR arrays of unsigned
integers, a more compact representation can often be achieved by adopting the
widely used representation of object identifiers defined in BER; this
representation may also be more amenable to processing by other software that
makes use of object identifiers."

compared to:

"Staying close to the way object identifiers are encoded in ASN.1 BER makes
back-and-forth translation easy; otherwise we would choose a more efficient
encoding."

Regards,
Rob