[core] raza-ace-cbor-certificates

[Michael Richardson <[e-mail]>]

If we transcode ASN.1 to CBOR rather than DER in a way that preserves the
signature, then I think we miss all opportunities to throw away the DER code.

If we can outsource this to a third party to verify, we can just throw the
DER itself to the third party, and wrap it in a RESTful COAP interface.

I see two issues with PKIX certificates:
  a) DNs never made any sense in 1980 when a company could have three
     people named John Smith, and they make even less sense now that we
     have 10,000 light bulbs whose name is "serialNumber=XXXXX"
  b) while subject DNs can be empty, issuer DNs can't be empty if you want to
     verify the certificate.
     Finding the public key of the issuer to verify the certificate is
     annoying and often non-trivial.  There are PKIX extensions to deal
     with this, but they aren't mandatory.

These are essentially issues with how the certificate semantics are encoded
into the ASN.1, not really a problem with the DER itself.  The lack of good
DER encoders/decoders (I've never seen a pull parser, I'm sure Heimdal
includes one, but I've never seen it) is the PITA.

I couldn't figure out what the conclusion of your slides were, btw.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-