Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Tue, Feb 11, 2020 at 01:55:10PM -0500, Tony Rutkowski wrote:
> The patent would be worthless.  DNS for OID arc resolution was originally
> proposed by VeriSign's Michael Mealling about 20 years ago in RFC3061,

Yes, I know it was long ago enough that it's probably expired.  It's a
minor relief to know it must be!

> introduced again by VeriSign in ITU-T about 15 years ago, and then pursued
> by Korea's ETRI as a series of ITU-T standards X.672, X.674, X.675 and
> X.676.  The root resolver authority is allocated to the Korean Information
> Security Agency. It is known as the OID Resolution System (ORS).  Orange's
> research centre has long maintained a http based resolver at the OID
> Repository site, www.oid-info.com.  Note the KISA Activity for the ORS on
> the OID-INFO site.

Interesting.  Thanks for the info.

> OIDs rank as one of the most ubiquitous object identifiers and in addition
> to ASN.1 code and X.509 PKI cert information, it has found favor in recent
> years for IOT tagging.  It is resolved to all kinds of information.

Yes.  But they are not useful for _humans_.

We even use OIDs in APIs, e.g., the GSS-API.  A mistake that.  URNs are
much simpler and easier to use for developers.

Just say not to OIDs.  Use URNs, and if you have an OID, remember that
there's a URN form for OIDs.

Yes, of course, on the wire in PKIX and many other protocols we have to
use OIDs where the relevant protocols use them.  But there's no need to
bleed these into APIs, let alone UIs.

Nico
--