Re: IETF 53 SASL bar BoF minutes

["RL 'Bob' Morgan" <[e-mail]>]

On Thu, 28 Mar 2002, Laurence Lundblade wrote:

> Seems like you could put 10 or 20 certs in a 16Kb buffer. Are you expecting 
> chains longer than that? Seems that would be approaching meaningless in 
> terms of any real-world trust.

Depends on how big a cert is.  X.509 certs today are pretty minimal, but 
if you look in draft-ietf-pkix-new-part1-12.txt you'll see a whole pile of 
extensions that exist presumably so authorities can start using them, and 
other pkix docs specify yet more extensions.  There will presumably be 
struggle between PKI deployers wanting to jam lotsa stuff into their certs 
(some of which, like name constraints, are arguably essential to the 
overall security of the scheme) and small-device folks saying hey these 
things won't fit.  How big a typical cert will be 5 years from now is 
pretty hard to say, seems to me.

> Also, if the certs are ordered leaf to root and the whole record
> containing is not signed, you can process them with a smaller buffer.
> The only thing about SSL that requires the large buffer is that you have
> to verify the MAC/hash before passing the data along to the next layer.

Umm, I think you're talking about buffer management inside your 
implementation.  The issue at hand is, I think, the size of objects that 
SASL-profiled application protocols have to be able to handle to support 
an acceptable set of security mechanisms.

 - RL "Bob"