Re: [saag] ASN.1 vs. DER Encoding

[Watson Ladd <[e-mail]>]

On Mon, Apr 22, 2019 at 8:54 PM Nico Williams <[e-mail]> wrote:
>
> On Mon, Apr 22, 2019 at 07:54:52PM -0400, Russ Housley wrote:
> > > And x.400/x.500 naming is an awful disaster.
> >
> > They are not the same.  Once can completely avoid X.400 names, but the
>
> They are not, but they are similar, and similarly difficult to use.
>
> > X.500 one are used in certificates.  I strongly encourage people to
> > keep it simple.  The bits on the wire sitll get too complicated, but
> > the code can mostly do exact match processing.
>
> To keep it simple means to leave the subjectName empty and use dNSName
> and rfc822Name SANs instead wherever possible.
>
> Naming is more than half the battle.  Internet-style naming of things
> won long, long ago.  It's not just that users can handle domainnames and
> name@domainname syntax but not x.500, but that x.500 naming is
> fiendishly difficult to handle in code, or even in specs -- there's not
> even a lossless textual representation of x.500 names [RFC4514]!

Let us not forget the valiant battle to enforce the requirements that
CAs know that Bremerhaven is in Bremen and not in Niedersachsen. I
await the discovery that a small company in Baarle-Hertzog is actually
three feet across the border, with dire consequences for the web PKI.
(If the border moves and you don't, does the certificate need
revocation? Or what about countries being renamed?)
>
> Nico
> --
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.