Re: [saag] ASN.1 vs. DER Encoding

Late to this thread but thought I'd mention that the Interledger community
has been using Canonical OER for 4 years now.
Some rationale here: https://interledger.org/rfcs/0030-notes-on-oer-encoding

There are OER codecs available in a few languages as a result (Rust,
Typescript/Javascript, Java, Golang...) and our experience has been that
trying to write codecs that parse ASN.1 are over-kill.
i.e. They're hand-coded to provide the read/write functions needed by the
protocol.

As a general comment about OER, it is easy to use and understand and
writing code for it was significantly simpler than anything I have seen for
BER/DER etc.

It also helps that most number parsing follows the representations already
natively supported by most programming languages (not sure if that is also
true for BER/DER).

On Tue, 23 Apr 2019 at 20:25, Viktor Dukhovni <ietf-dane@dukhovni.org>
wrote:

> On Tue, Apr 23, 2019 at 10:19:31AM -0500, Nico Williams wrote:
>
> > On Tue, Apr 23, 2019 at 11:08:23AM -0400, Michael Richardson wrote:
> > >     >> X.500 one are used in certificates.  I strongly encourage
> people to
> > >     >> keep it simple.  The bits on the wire sitll get too
> complicated, but
> > >     >> the code can mostly do exact match processing.
> > >
> > >     > To keep it simple means to leave the subjectName empty and use
> dNSName
> > >     > and rfc822Name SANs instead wherever possible.
> > >
> > > Yes, but we can't leave the IssuerDN empty, and if we want chains of
> > > certificates (we do), then we need to put something into the subjectDN.
> >
> > Well, there is id-ce-issuerAltName, but indeed, the issuer Name must not
> > be empty.
>
> Of course the chaining need not in principle have been based on a
> fictional global X.509 directory tree.  It could have been just key
> ids, with the CA names as commentary for human eyes and audit trails.
> The only downside would then be loss of the ability to bypass path
> length constraints via self-issued certificates.  Not clear we'd
> really miss that.  But this is of course entirely hypothetical...
>
> FWIW, despite clear non-compliance with RFC 5280 and potential
> interoperability risk, some users seem to manage with "self-signed"
> (below skid == akid) certificates that have empty DNs for *both*
> the subject and the issuer (and indeed no SANs of any kind).
>
> These are of course outside the WebPKI, used solely for unauthenticated
> or DANE TLS.  A live example below, yes, in continuous use for the
> last 5 years or so. [ The 4096-bit RSA key and ~1000 year validity
> is a bold challenge to the coming scalable QC crypto apocalypse.
> :-) ]
>
> --
>         Viktor.
>
> Certificate:
>     Data:
>         Version: 3 (0x2)
>         Serial Number:
>             c3:26:2b:13:ca:b1:36:72
>         Signature Algorithm: sha256WithRSAEncryption
>         Issuer:
>         Validity
>             Not Before: Jul 27 14:59:59 2014 GMT
>             Not After : Nov 27 14:59:59 3013 GMT
>         Subject:
>         Subject Public Key Info:
>             Public Key Algorithm: rsaEncryption
>                 RSA Public-Key: (4096 bit)
>                 Modulus:
>                     00:b6:d3:42:35:68:e9:2a:9e:ba:f8:f0:f4:bf:30:
>                     b5:0b:40:cd:10:4b:20:94:aa:fc:e8:d3:b1:b8:15:
>                     cc:24:ba:7f:95:b5:85:92:e9:d5:97:70:d3:fd:b3:
>                     c9:91:ba:d5:85:5d:c6:6d:98:8b:c3:b3:79:74:a7:
>                     41:c6:f4:df:14:53:bb:90:21:72:71:ba:e2:56:03:
>                     0a:0b:a9:db:d5:92:d3:90:58:4e:eb:a4:8b:51:80:
>                     db:5f:56:26:cf:9b:26:a8:2e:42:df:54:14:86:4e:
>                     1f:ad:b2:9c:57:54:16:7a:39:25:a3:b3:90:97:eb:
>                     70:92:04:27:10:b6:fd:9e:70:4f:b2:02:e2:fa:6d:
>                     90:eb:9a:0c:64:3c:31:86:4c:98:99:47:00:75:b6:
>                     d0:bb:80:02:13:c7:43:97:24:ec:1e:3e:b1:1c:d6:
>                     c7:b7:de:fc:e8:bb:c6:d8:20:74:16:09:27:2d:17:
>                     17:a5:a4:41:d0:f6:60:de:a2:84:fa:e4:8d:dd:1e:
>                     98:7e:19:75:a4:87:52:18:45:d9:6d:39:3e:2c:b2:
>                     64:1a:13:37:26:3f:72:8c:7d:fe:2e:d6:26:d7:cc:
>                     37:aa:06:4a:2f:ea:bc:0f:00:5f:d5:30:79:e8:11:
>                     21:64:03:b9:91:e5:da:47:6b:7d:43:e6:5e:20:e8:
>                     1d:1d:1e:3d:b8:57:62:01:98:13:5b:cc:a8:9f:6b:
>                     d2:34:e0:6f:86:b8:ac:9d:89:f1:e9:27:b9:f8:55:
>                     ce:a2:8a:33:2b:ac:3a:65:c0:fb:12:b8:f7:5a:47:
>                     a6:ea:83:80:88:0f:ca:d4:d5:dc:62:5c:08:d9:cf:
>                     e6:ca:fe:32:00:9e:e3:c0:53:99:21:a3:c9:4f:66:
>                     07:fc:61:e2:20:18:01:7f:61:dd:e1:72:b5:fd:c3:
>                     97:23:2a:51:bf:42:58:64:0d:2b:4e:cc:85:a0:5e:
>                     01:52:2b:7b:46:f0:63:19:9b:a3:5e:2c:70:23:36:
>                     a3:a9:3a:b3:60:2e:ad:78:68:96:ce:a4:4c:ea:13:
>                     77:02:97:c4:55:82:f3:fd:3b:f3:f4:65:4e:dd:3b:
>                     fe:d2:dd:d0:da:29:e8:3e:dd:a9:e3:c6:16:db:eb:
>                     f8:90:72:dc:54:37:17:15:c9:43:1f:de:9d:5b:02:
>                     5e:03:a9:3e:78:75:15:4d:bc:84:bf:a0:7e:4a:68:
>                     7d:2b:c6:c5:b5:da:09:8b:f3:45:6e:82:2b:8b:be:
>                     e9:5d:b7:b3:f0:e8:0d:04:8c:e3:b8:ca:23:1d:dc:
>                     10:09:09:2e:1e:bf:23:4c:67:be:64:c1:90:fd:62:
>                     57:17:d4:33:e6:1d:4c:70:d7:58:f6:17:5e:d2:4b:
>                     d5:1f:9b
>                 Exponent: 65537 (0x10001)
>         X509v3 extensions:
>             X509v3 Subject Key Identifier:
>                 98:C6:9B:D5:20:5C:1D:A8:31:39:BD:78:11:37:FF:BD:AD:5B:BD:59
>             X509v3 Authority Key Identifier:
>
> keyid:98:C6:9B:D5:20:5C:1D:A8:31:39:BD:78:11:37:FF:BD:AD:5B:BD:59
>
>             X509v3 Basic Constraints:
>                 CA:TRUE
>     Signature Algorithm: sha256WithRSAEncryption
>          8d:47:1d:df:5f:63:ec:db:7b:a3:a3:a6:50:d0:76:f5:1a:86:
>          da:21:bf:78:4d:4c:ab:ef:af:a1:be:e9:a5:29:20:6b:05:a3:
>          88:85:0e:57:17:9c:e6:8c:f5:87:c7:07:a3:7b:ed:7d:f4:03:
>          07:5a:6e:b4:bf:9c:db:6d:33:24:ae:4d:0e:39:06:54:9e:71:
>          68:f6:5d:58:e9:19:ff:ef:e2:e5:7c:a9:b9:da:21:dd:14:19:
>          d8:c1:6b:ab:ae:fd:2f:86:14:b9:8f:bf:77:75:b8:07:cc:0a:
>          62:8a:00:98:c4:fb:0e:ec:ef:f7:11:88:0a:05:0e:ef:9b:c0:
>          98:e0:39:47:c0:83:af:5a:f6:aa:3d:8f:2c:5d:b1:95:b4:93:
>          a1:86:bf:1d:b1:45:91:e5:7f:6f:63:ab:59:cf:03:4e:c0:37:
>          fe:ce:9f:2d:cd:64:a1:81:62:00:79:32:4d:b0:43:2e:58:6e:
>          c7:79:f7:b6:74:be:c9:65:c6:2f:d0:e9:b8:56:60:d4:46:48:
>          d8:6d:da:b2:81:59:a9:f4:94:8c:c4:9f:f6:ab:16:6f:f1:04:
>          e7:e9:2a:bb:04:1f:4d:c5:c2:e0:0b:b0:60:d8:1c:31:59:da:
>          c6:32:6c:77:8b:db:e7:77:88:4d:15:45:c9:ea:b8:95:5a:d3:
>          d6:5f:19:ed:cd:5d:84:0d:30:75:70:ac:a3:9a:6d:83:fe:bc:
>          60:fa:bb:2b:48:d7:12:eb:4a:e3:40:bf:01:56:a9:0d:d4:fc:
>          49:88:70:6b:0a:24:36:e8:c2:dd:ea:6c:67:cf:5e:d2:0a:7a:
>          31:b8:92:93:7c:f5:8c:91:8e:e9:d9:39:ec:1f:f2:98:0c:3d:
>          d5:33:33:53:bd:b1:63:b6:18:e3:20:c6:50:2a:f1:09:50:5d:
>          88:69:76:91:38:a1:c1:47:71:09:12:75:6d:a0:17:72:ad:e6:
>          78:40:18:d3:04:04:70:3a:bf:74:45:0c:48:7a:7b:fe:0a:fd:
>          ff:cb:ae:f7:85:50:fa:e2:23:73:87:54:ea:80:7e:c9:5f:da:
>          80:3f:af:04:3a:58:d8:4b:24:75:58:a0:c5:94:0a:b8:8e:62:
>          15:7e:3e:da:41:a8:a2:80:1b:c6:43:03:ae:2c:8c:fc:c7:83:
>          df:38:df:b8:12:d2:ac:c1:10:b4:66:75:77:c8:a5:6f:49:16:
>          c4:27:04:c2:fe:52:a4:ef:62:86:25:00:e7:ce:02:e7:4d:6c:
>          c8:60:83:1f:4c:ba:d9:1b:83:da:cc:5d:bf:89:37:04:a7:85:
>          62:de:4d:2c:4e:d0:13:c4:cd:81:51:4a:b0:07:53:95:6f:42:
>          9e:2e:32:12:7b:1c:c1:c3
> -----BEGIN CERTIFICATE-----
> MIIE1TCCAr2gAwIBAgIJAMMmKxPKsTZyMA0GCSqGSIb3DQEBCwUAMAAwIBcNMTQw
> NzI3MTQ1OTU5WhgPMzAxMzExMjcxNDU5NTlaMAAwggIiMA0GCSqGSIb3DQEBAQUA
> A4ICDwAwggIKAoICAQC200I1aOkqnrr48PS/MLULQM0QSyCUqvzo07G4Fcwkun+V
> tYWS6dWXcNP9s8mRutWFXcZtmIvDs3l0p0HG9N8UU7uQIXJxuuJWAwoLqdvVktOQ
> WE7rpItRgNtfVibPmyaoLkLfVBSGTh+tspxXVBZ6OSWjs5CX63CSBCcQtv2ecE+y
> AuL6bZDrmgxkPDGGTJiZRwB1ttC7gAITx0OXJOwePrEc1se33vzou8bYIHQWCSct
> FxelpEHQ9mDeooT65I3dHph+GXWkh1IYRdltOT4ssmQaEzcmP3KMff4u1ibXzDeq
> Bkov6rwPAF/VMHnoESFkA7mR5dpHa31D5l4g6B0dHj24V2IBmBNbzKifa9I04G+G
> uKydifHpJ7n4Vc6iijMrrDplwPsSuPdaR6bqg4CID8rU1dxiXAjZz+bK/jIAnuPA
> U5kho8lPZgf8YeIgGAF/Yd3hcrX9w5cjKlG/QlhkDStOzIWgXgFSK3tG8GMZm6Ne
> LHAjNqOpOrNgLq14aJbOpEzqE3cCl8RVgvP9O/P0ZU7dO/7S3dDaKeg+3anjxhbb
> 6/iQctxUNxcVyUMf3p1bAl4DqT54dRVNvIS/oH5KaH0rxsW12gmL80VugiuLvuld
> t7Pw6A0EjOO4yiMd3BAJCS4evyNMZ75kwZD9YlcX1DPmHUxw11j2F17SS9UfmwID
> AQABo1AwTjAdBgNVHQ4EFgQUmMab1SBcHagxOb14ETf/va1bvVkwHwYDVR0jBBgw
> FoAUmMab1SBcHagxOb14ETf/va1bvVkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
> AQsFAAOCAgEAjUcd319j7Nt7o6OmUNB29RqG2iG/eE1Mq++vob7ppSkgawWjiIUO
> Vxec5oz1h8cHo3vtffQDB1putL+c220zJK5NDjkGVJ5xaPZdWOkZ/+/i5Xypudoh
> 3RQZ2MFrq679L4YUuY+/d3W4B8wKYooAmMT7Duzv9xGICgUO75vAmOA5R8CDr1r2
> qj2PLF2xlbSToYa/HbFFkeV/b2OrWc8DTsA3/s6fLc1koYFiAHkyTbBDLlhux3n3
> tnS+yWXGL9DpuFZg1EZI2G3asoFZqfSUjMSf9qsWb/EE5+kquwQfTcXC4AuwYNgc
> MVnaxjJsd4vb53eITRVFyeq4lVrT1l8Z7c1dhA0wdXCso5ptg/68YPq7K0jXEutK
> 40C/AVapDdT8SYhwawokNujC3epsZ89e0gp6MbiSk3z1jJGO6dk57B/ymAw91TMz
> U72xY7YY4yDGUCrxCVBdiGl2kTihwUdxCRJ1baAXcq3meEAY0wQEcDq/dEUMSHp7
> /gr9/8uu94VQ+uIjc4dU6oB+yV/agD+vBDpY2EskdVigxZQKuI5iFX4+2kGoooAb
> xkMDriyM/MeD3zjfuBLSrMEQtGZ1d8ilb0kWxCcEwv5SpO9ihiUA584C501syGCD
> H0y62RuD2sxdv4k3BKeFYt5NLE7QE8TNgVFKsAdTlW9Cni4yEnscwcM=
> -----END CERTIFICATE-----
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>