RE: New Liaison Statement, "Liaison to IETF on the removal of upper bound in X.509"

["Kemp, David P." <[e-mail]>]

A normative upper bound has the undesirable effect of requiring
implementations to be less liberal in what they accept.  An informative
upper bound provides guidance to CAs on maximizing interoperability,
and does not penalize relying applications that can accept much larger
structures.  If five years from now 99% of relying applications
can accept large fields (e.g. up to available memory) and the other
1% never move beyond hard-coded limits, then a CA can *never* exceed
the old bounds without risking unexpected incompatibility.  Nonetheless,
it is desirable to permit a CA to issue oversized certs that are
accepted
by 99% of relying products rather than requiring all relying products
to reject such certs as a condition of PKIX (but not X.509) compliance.



-----Original Message-----
From: [e-mail] [mailto:[e-mail]]
On Behalf Of Hallam-Baker, Phillip
Sent: Monday, October 08, 2007 7:32 PM
To: Stephen Farrell; Russ Housley
Cc: [e-mail]
Subject: RE: New Liaison Statement, "Liaison to IETF on the removal of
upper bound in X.509"


How long will it be before I can issue a certificate that does not
comply with the old bounds without this resulting in unexpected
incompatibilities?
 

> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Stephen Farrell
> Sent: Saturday, October 06, 2007 3:50 PM
> To: Russ Housley
> Cc: [e-mail]
> Subject: Re: New Liaison Statement, "Liaison to IETF on the 
> removal of upper bound in X.509"
> 
> 
> 
> 
> Russ Housley wrote:
> > Personally, I missed the subtle change from normative to 
> informative.  
> > I suspect many others did too.  If the PKIX WG to make them 
> > informative too, then it will have to be done *right now*.
> 
> I see no reason to make such a change at this stage.
> 
> S.
> 
>