Re: [pkix] Amendment to CABF Baseline Requirements

Erwann Abalea <eabalea@gmail.com> Fri, 07 April 2017 07:15 UTC

Return-Path: <eabalea@gmail.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50A8E128CFF for <pkix@ietfa.amsl.com>; Fri, 7 Apr 2017 00:15:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Level:
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k5IXZl3eW7_h for <pkix@ietfa.amsl.com>; Fri, 7 Apr 2017 00:15:27 -0700 (PDT)
Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 044FB1288B8 for <pkix@ietf.org>; Fri, 7 Apr 2017 00:15:27 -0700 (PDT)
Received: by mail-qk0-x22e.google.com with SMTP id h67so56274740qke.0 for <pkix@ietf.org>; Fri, 07 Apr 2017 00:15:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=a8SqjnVWxS2YpPbTZl6pH3VsLJOYBk+cFi9rre2xzHU=; b=XLuD6SKQaCAk/c1Rtb6LWOjsjYR/NJ5sOie5MOgKgLuOHz6m1S7x7+IEgc/DZCxgjv aOMiT1/Vvo9zVkzo9KSh3o9jrfSGOzy+ATZLA90L9Ul642x7gPogoTRiHudws/2XZ8r9 LsO/CVX+svLXomZeh+Kx53VzKwZ4r7fmR2N4RF8jPeNaiP9O0vT5jH95zm3tilnOSjXn KyXu6pryUqO9r27q0MPteuwiYlgy1bpskncDV19FElYrh+ZGH+V07GugrQjdOErQlven oBmW0k6iaR4BoRTCbQ3MKE4SGw8DFKMxy/tBgMvczDgSD4fTHJqfvz7AtdtCyYSebeRr IwcQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=a8SqjnVWxS2YpPbTZl6pH3VsLJOYBk+cFi9rre2xzHU=; b=gNyf6mlBhl2GuwRVNIDiMaO+rcQwvH3xuYeQE8RTyAKuB9M7ptG7iKHnpuy8GvqQQN K3mNNd6rkrrNXOSsvLp85EcEsIPN7NDjpan4vPY7loqb9MF0nKrD/y9RXdZKjavlg5F4 Yr/sNw8upG8ibKPVO4tSKGCAmm/wwzvsg12eU71lcENaMt7rGX8jkffjgN10zSiOvWfz W3E3FoAzDmv5LzkrXPcU42wchKnra9PttnKoipjv5yx+8r8+drlCjE7ICiPiIuGvjnXM lvl888kbAb4kcDcfnmI2xN8skOqwfzkx6n7V3SkR5A3JlXZR1ZUOfnQyHkP1d73NXKbG 3YCw==
X-Gm-Message-State: AFeK/H1EELZQr+3QNfGgIXCpICVnbkmz1LmFhz/fcVQ2fabxX3aJ42VYvbiJVOU3++sPewSFi22q4094rygjLA==
X-Received: by 10.55.104.14 with SMTP id d14mr34900536qkc.299.1491549326101; Fri, 07 Apr 2017 00:15:26 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.140.32.182 with HTTP; Fri, 7 Apr 2017 00:15:25 -0700 (PDT)
In-Reply-To: <CAK6vND9-oxL_acNk21D36UeXHqUM0Rz57cpB_zpCJaTJMPeZ2g@mail.gmail.com>
References: <906f1c1dde4f44789646197d887da312@EX2.corp.digicert.com> <a24a24b9-542c-a619-3445-47e812f9c46b@nthpermutation.com> <27e9bc684735472bbd6d7f82b5e2823b@EX2.corp.digicert.com> <662C0D5C-EF34-4BD1-B3BC-B7B9A84B4990@vigilsec.com> <CAK6vND9-oxL_acNk21D36UeXHqUM0Rz57cpB_zpCJaTJMPeZ2g@mail.gmail.com>
From: Erwann Abalea <eabalea@gmail.com>
Date: Fri, 7 Apr 2017 09:15:25 +0200
Message-ID: <CA+i=0E5Bh=_b1ZK2T_Y9bj6GivtOJq2Y23i071=wS=jph68tog@mail.gmail.com>
To: Peter Bowen <pzbowen@gmail.com>
Cc: Ben Wilson <ben.wilson@digicert.com>, Russ Housley <housley@vigilsec.com>, IETF PKIX <pkix@ietf.org>
Content-Type: multipart/alternative; boundary=94eb2c057254bf65aa054c8e630a
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/jkCYo3uO2MmqmvyZa-tQ5b4V1CM>
Subject: Re: [pkix] Amendment to CABF Baseline Requirements
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Apr 2017 07:15:29 -0000

Bonjour,

2017-04-06 22:39 GMT+02:00 Peter Bowen <pzbowen@gmail.com>om>:

>
> On Thu, Apr 6, 2017 at 12:24 PM Russ Housley <housley@vigilsec.com> wrote:
>
>> The comment in the UpperBounds ASN.1 module (the 8th edition) says:
>>
>> -- EXPORTS All
>> -- The types and values defined in this module are exported for use in
>> the other ASN.1
>> -- modules contained within these Directory Specifications, and for the
>> use of other
>> -- applications which will use them to access Directory services. Other
>> applications
>> -- may use them for their own purposes, but this will not constrain
>> extensions and
>> -- modifications needed to maintain or improve the Directory service.
>>
>> X.509 is part of the Directory Specifications, so they are not advisory.
>>
>> It looks like ITU-T increased the length of the organizational unit name
>> in the most recent edition.
>>
>> RFC 5280 says:
>>
>> ub-organization-name-length INTEGER ::= 64
>> ub-organizational-unit-name-length INTEGER ::= 32
>>
>> The UpperBounds ASN.1 module (the 8th edition) says:
>>
>> ub-organization-name                       INTEGER ::= 64
>> ub-organizational-unit-name                INTEGER ::= 64
>>
>> So, we may already be in a place where implementations conforming to
>> X.509 will produce a certificate that cannot be decoded by an
>> implementation that conforms to RFC 5280.
>>
>> I wish we gad gotten a heads-up …
>
>
> It is even worse. 7th and 8th (and maybe prior releases) removed the usage
> of ub- from the schema. The schema itself no longer bounds DirectoryStrings
> and X.509 explicitly says they are unbounded.
>

X.520 2005 defines the attributes using the DirectoryString{} parameterized
type, while the 2008 edition uses the UnboundedDirectoryString type.

RFC5912, which proposes ASN.1 modules for certificates and other related
things, still uses the DirectoryString{} variant.

-- 
Erwann.