Re: [dane] I-D Action: draft-ietf-dane-smime-04.txt

Viktor Dukhovni <viktor1dane@dukhovni.org> Wed, 08 January 2014 16:02 UTC

Return-Path: <viktor1dane@dukhovni.org>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C422B1AE4D1 for <dane@ietfa.amsl.com>; Wed, 8 Jan 2014 08:02:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id npAuFkucMduq for <dane@ietfa.amsl.com>; Wed, 8 Jan 2014 08:02:05 -0800 (PST)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) by ietfa.amsl.com (Postfix) with ESMTP id BE4781AD9AD for <dane@ietf.org>; Wed, 8 Jan 2014 08:02:05 -0800 (PST)
Received: by mournblade.imrryr.org (Postfix, from userid 1034) id 2E9632AB190; Wed, 8 Jan 2014 16:01:56 +0000 (UTC)
Date: Wed, 8 Jan 2014 16:01:56 +0000
From: Viktor Dukhovni <viktor1dane@dukhovni.org>
To: dane@ietf.org
Message-ID: <20140108160156.GE2317@mournblade.imrryr.org>
References: <20140108152321.10496.88212.idtracker@ietfa.amsl.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20140108152321.10496.88212.idtracker@ietfa.amsl.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [dane] I-D Action: draft-ietf-dane-smime-04.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: dane@ietf.org
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Jan 2014 16:02:08 -0000

On Wed, Jan 08, 2014 at 07:23:21AM -0800, internet-drafts@ietf.org wrote:

> 	Filename        : draft-ietf-dane-smime-04.txt

Given the use of base32 encoding, and explicit non-support for
names that encode to more than 63 bytes of base32 text, I would
like to suggest that trailing "=*" padding be explicitly dropped
from the base32 label allowing for somewhat longer inputs and less
redundant outputs.

With base32, every 5 octets of input text encode to 8 octets of
encoded text, therefore 35 octets encode to 56 octets, but anything
longer encodes to 64 octets which is too long.  Thus inputs with
36-39 octets cannot be represented when the "=" padding is part
of the encoded text.

Also, with say "6" octets of input, e.g. "viktor", we have 48 bits
of input which encodes to 9 full octets of 5 bit per octet output,
plus a short 3 bit encoded octet, and then *7* octets of padding:

	OZUWW5DPOI======

This seems rather wasteful.  The truncated encoding:

    OZUWW5DPOI

carries identical information.

Finally is the word "prohibited" appropriate in the new text:

       Also note that user names can be any length, and labels are
       limited to 63 octets.  Also note that user names that are
       encoded with Base32 are longer than the original user name.
       Any user name that would cause a label of longer than 63
       octets is expressly prohibited by this specification.

I would think "unsupported" or "incompatible" would be closer,
since such local parts remain valid, even though there are incompatible
with SMIMEA.

One way to get around the length limit would be to break up long
encoded strings into multiple labels at each 32 bytes of output
(which decode to 20 bytes of input).  Thus the encoding of "Base32
is a notation for encoding arbitrary byte data using a restricted
set of symbols":

    IJQXGZJTGIQGS4ZAMEQG433UMF2GS33O
    EBTG64RAMVXGG33ENFXGOIDBOJRGS5DS
    MFZHSIDCPF2GKIDEMF2GCIDVONUW4ZZA
    MEQHEZLTORZGSY3UMVSCA43FOQQG6ZRA
    ON4W2YTPNRZQ			// trailing "====" truncated

would result in a multi-label DNS prefix of:

    ijqxgzjtgiqgs4zameqg433umf2gs33o.ebtg64ramvxgg33enfxgoidbojrgs5ds.mfzhsidcpf2gkidemf2gcidvonuw4zza.meqhezltorzgsy3umvsca43foqqg6zra.on4w2ytpnrzq

Allowing for significantly longer local parts (ultimately limited
by the total length of a DNS fqdn when combined with the relevant
suffix derived from the domain part).

-- 
	Viktor.