Re: [pkix] a question of cert (and OCSP) extension syntax

[Peter Gutmann <[e-mail]>]

Stephen Kent <[e-mail]> writes:

>Since the bulk of the data items have an obvious ASN.1 representation, and
>the certificate or TBS certificate are native ASN.1 structures, we feel that
>the decision to stuff all of the data items into an OCTET STRING is
>inappropriate, and that it sets a bad precedent for others developing
>certificate (and OCSP) extensions in the future

I'd already discussed this in private with some of the folks involved, my
reasoning was exactly the same as yours, if you want this to be able to be
processed by anything that uses certs then it has to be compatible with
standard PKI software, which means encoding it in a form that PKI software can
work with it.  Their response was that it was only intended for use in TLS so
having it as an opaque (outside of TLS) blob wasn't a problem.  I didn't agree
with that because it's either going to fail and sink without a trace, or
succeed and end up being used in lots of places that aren't TLS, neither of
which are compatible with the TLS-only view.

The impression I got was that the decision to use the TLS encoding was a
foregone conclusion and there wasn't much chance of changing it.

Peter.