IETF Logo Mail Archive

Re: [pkix] a question of cert (and OCSP) extension syntax

Russ Housley <housley@vigilsec.com> Tue, 31 March 2015 15:04 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD3EF1ACDF2 for <pkix@ietfa.amsl.com>; Tue, 31 Mar 2015 08:04:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.9
X-Spam-Level:
X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8PL8yzTN8iWU for <pkix@ietfa.amsl.com>; Tue, 31 Mar 2015 08:04:12 -0700 (PDT)
Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 62C911ACDEF for <pkix@ietf.org>; Tue, 31 Mar 2015 08:04:12 -0700 (PDT)
Received: from localhost (unknown [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id 46A159A4054; Tue, 31 Mar 2015 11:04:02 -0400 (EDT)
X-Virus-Scanned: amavisd-new at smetech.net
Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id aEUP8Cs8HygD; Tue, 31 Mar 2015 11:03:36 -0400 (EDT)
Received: from [192.168.2.100] (pool-96-255-133-185.washdc.fios.verizon.net [96.255.133.185]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id B4A9B9A4055; Tue, 31 Mar 2015 11:03:36 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v1085)
Content-Type: text/plain; charset="us-ascii"
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <B679DABC-5B8B-40C4-A7C3-527227D4A876@vpnc.org>
Date: Tue, 31 Mar 2015 11:03:25 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <9CF25F90-396C-4341-B04D-E850BDBA7339@vigilsec.com>
References: <00d201d06b68$779e2c90$66da85b0$@akayla.com> <B679DABC-5B8B-40C4-A7C3-527227D4A876@vpnc.org>
To: Paul Hoffman <paul.hoffman@vpnc.org>
X-Mailer: Apple Mail (2.1085)
Archived-At: <http://mailarchive.ietf.org/arch/msg/pkix/cB27q5EqIoP8om5K74NMBIIi6k0>
Cc: IETF PKIX <pkix@ietf.org>
Subject: Re: [pkix] a question of cert (and OCSP) extension syntax
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 31 Mar 2015 15:04:17 -0000

Paul:

>> We've been doing ASN.1 for more than 20 years.  Is it really that hard to
>> encode things as ASN.1?
> 
> If it means that the system doing the encoding has to add ASN.1 code just to do the encoding, yes. There are few ASN.1 libraries, and they are only lightly maintained. You are asking for security applications to carry around additional code that would otherwise be unnecessary.
> 
> If it was assumed that all PKIX-processing software would need to descend into this extension, there might be a better argument, but they don't.

ASN.1 processing is needed to get the value of the OCTET STRING from the extension, so I do not understand the point you are trying to make.

Russ

v2.27.8 | Report a Bug | By Email | System Status