Re: [secdir] Secdir review of draft-josefsson-pkix-textual

Yoav Nir <> Wed, 03 December 2014 12:02 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id BF3401A1A74; Wed, 3 Dec 2014 04:02:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.699
X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id K3E3WasfmPFf; Wed, 3 Dec 2014 04:02:04 -0800 (PST)
Received: from ( [IPv6:2a00:1450:400c:c00::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D5C941A1A7F; Wed, 3 Dec 2014 04:01:48 -0800 (PST)
Received: by with SMTP id n12so19783326wgh.20 for <multiple recipients>; Wed, 03 Dec 2014 04:01:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=Z8dvQ+NwRS8WSbWUNKB6wiIEkzMUpbc0SpJd44UC3kE=; b=gJT7uImU1Aq0rFL7Gi5cHL/EGkH5WyKedb00/fncnFaazAOKDKTJOTQaLDw6x+vV/x r3qtkB4atSjscfbrH34tkoFxnVIemClGFKlsJF9yjE1d21V7qPJwOG1E01iOI6Yo6TBR T8kR6s+gXd2IFlwdtIXisgAfUxxz7hpa1jknw62wIVaOTlGw5Wr/ZWOs5Ya1Zbh4Zlyy jsxxROMB9chLb69dCWuzSHATYsuxPKWa4cOOsXOKdLQF+BnOD0gnsJLh5mWcpVmoJwbP CqlBghgSCh7VGXeS/DtbKIqFmMNt67ODfUwgBYfgwhDfcAcrxLyVBQOgF0gAlTb6kxdy /dxg==
X-Received: by with SMTP id dt2mr101579120wib.66.1417608107669; Wed, 03 Dec 2014 04:01:47 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id h13sm50477870wiw.4.2014. for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 03 Dec 2014 04:01:47 -0800 (PST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_1C994D20-EC69-4508-98B3-36AA56E86263"
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
From: Yoav Nir <>
In-Reply-To: <>
Date: Wed, 3 Dec 2014 14:01:44 +0200
Message-Id: <>
References: <>
To: =?utf-8?Q?Magnus_Nystr=C3=B6m?= <>
X-Mailer: Apple Mail (2.1993)
Cc: IESG <>,, "" <>
Subject: Re: [secdir] Secdir review of draft-josefsson-pkix-textual
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 03 Dec 2014 12:02:05 -0000

Hi Magnus

[adding IESG]

See below

> On Dec 2, 2014, at 4:19 PM, Magnus Nyström <> wrote:
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.
> This memo documents textual encodings of various well-established PKI-related data structures and formats. The document is intended to be published as a Standards-Track RFC.
> Comments and suggestions:
> Section 5.1:
>  - For clarity and common keyword usage, suggest replacing "The encoded data MUST be a BER (DER strongly preferred) encoded ASN.1..." with: "The encoded data MUST be BER and SHOULD be a DER encoded ASN.1..." (In fact this comment goes for all places where you have text like "MUST be a BER (DER [strongly] preferred" - better to use established RFC 2119 language).

In general (this is not a hard and fast rule) a SHOULD should come with an explanation of when it isn’t needed. Unless we have a good case for saying when it’s OK to use non-DER, I’d rather stick with the non-2119 “prefer”.

> - I wonder why you state "Parsers are NOT RECOMMENDED to treat "X509 CERTIFICATE" or "X.509 CERTIFICATE" as equivalent to "CERTIFICATE", but a valid exception may be for backwards compatibility (potentially together with a warning)" since to my knowledge, they all refer to the same structure and in the spirit of "strict in issuance, generous in receipt", it would seem to be better to state: ""Parsers MAY treat ... as equivalent to "CERTIFICATE" “ ?

I’ll leave this to the authors to answer.

> - I also wonder about the warning above since if the structure indeed does parse as a certificate, what value would the warning bring (and to whom)?


> Section 5.3:
> I disagree with the deprecation of .cer in favor of .crt. The .cer convention is used broadly. I would suggest updating the text to recommend use of .crt OR .cer. Better yet, remove the section, since this document specifically is about textual encodings and not file extension naming and you do not discuss extension naming elsewhere.

IDK. These formats are used mostly in files, and despite twenty years of attempts, classification by extension is still the norm. .cer files often contain either BER or a textual representation, while .crt tends to mostly be textual. I don’t see why we shouldn’t document this convention.

> Section 6:
> Same comments as for Section 5.1 above, but for CRLs...
> Section 7:
> Same comment as my first for Section 5.1. I note that you have the same language with regards to parser flexibility here that I have suggested for Section 5.1 and Section 6.
> Security Considerations:
> No particular comments.
> — Magnus