IETF Logo Mail Archive

[lamps] Re: Call for adoption of draft-davidben-x509-alg-none

Andrew Chen <andrew.pkichat@gmail.com> Thu, 27 February 2025 17:43 UTC

Return-Path: <andrew.pkichat@gmail.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 738802FBBAA for <spasm@mail2.ietf.org>; Thu, 27 Feb 2025 09:43:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietfa.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietfa.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6as0OZJGR1T2 for <spasm@mail2.ietf.org>; Thu, 27 Feb 2025 09:43:37 -0800 (PST)
Received: from mail-ed1-x543.google.com (mail-ed1-x543.google.com [IPv6:2a00:1450:4864:20::543]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id AA68F2FBB92 for <spasm@ietf.org>; Thu, 27 Feb 2025 09:43:37 -0800 (PST)
Received: by mail-ed1-x543.google.com with SMTP id 4fb4d7f45d1cf-5ded69e6134so1999534a12.0 for <spasm@ietf.org>; Thu, 27 Feb 2025 09:43:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740678217; x=1741283017; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=DiY8taGtQO0Dz/gFrYb5Vw9suHrMYWmJuNw2vOGpdk4=; b=MgD4UfDuotPMDsbdoMHaWKOV9vSjZwbhT4nHbfDECrjXGJcZZmAkpTeyUfnDiYgSTU Su9nc6yLcXYJLmQfOAsFHpTl851qBIntt+TEgENA6IFoUGl5QS7HLdaCYMkz8Ar/hFFL TZlFi1qLUtX4pXE+MOwiX2k7KgtSgdmG9iMe0nzxUhLRJI6M9XKb5VGC74LEcysaT0Qh y4Exlti3voEELtWMTwj8KL/fJzmnWMjOL1ooG3qnCiZ6Yc7carR7zZfdV3iChXVBwTWF UE/hLJkKbB/81Tqs3kX+MUN3GkDtIHeeVe/WdcMkUQgcty1aZMLYtwXMr4TYi1O23nlC jEJw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740678217; x=1741283017; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=DiY8taGtQO0Dz/gFrYb5Vw9suHrMYWmJuNw2vOGpdk4=; b=dH5Q0h2OJCLHnZnK+2BXLd/0YLjf96pbLOQRu4uSdLRU3IJVnJFeX2cqRQ1pHC9eUh tZcHh969PWzmQH6SXciGl+Iiy1gcM77rBX4IFJPEVfh+mVYjQ4lAX+ay7ZzXRH/t5lKf xhdgoLfaGKLlHKrgulGurQy0kggq1X/t+t6a2ddQjAwlh7xGkw8pqy9IRPQD+/ORKEyX GLSI3gtl8DtZdsqkYFNBqlu2x1KGH9WkinZrDVp6cSvwINA3g2Tx1yQ6OYI5nOy7TFe4 Eum+cbUpb2Wy8G/nFa/WYGj5UtFYLMAzk9yjrPNZKyfDYeGMG6RSfOZqlT0MUbrd2FD9 V0LA==
X-Forwarded-Encrypted: i=1; AJvYcCUjoSX3lXNJyKfvN7q1go/l8+f4j8hHsOd9VvaFNoCWJiUBuEA27O3Fi+ntxXSRRespUzAuZg==@ietf.org
X-Gm-Message-State: AOJu0Yxa49gc0PBYqmfePMEVsh87wUpZsT4d4UDMsYtzf7NjzRlFrRCz cNIt2pUvOglVDcx/AIB9Uvv5jCp8Wf2MCdy1iAML0sfEVRkG1Jsc6OpJcuu8fCP+bIUECvayDix K7JBJrk5yhh0aBF48Y+ysvtNny4dbTUHk
X-Gm-Gg: ASbGncu6T3PkC7461lNMTstsbDMrE5QuEibAer5996boGlV2goGK7BqjB9YGVp0ZI+0 Awrt8daDl04o0xmR9Gn313TRLn/p3pIi7sz+070BDD6jUAdxMGSfrwVv0ll9SSw3kjJUNzoypoQ nSu2DWlu9s
X-Google-Smtp-Source: AGHT+IHM0QTxThhJO7xOh2TlC/K6Lk4tch/gvjumgkYoxXjnrLEWNBLqGf8dJnlKFxlf74EZiEZ03zgsS6y55Xm1Hnk=
X-Received: by 2002:a05:6402:5019:b0:5d2:723c:a568 with SMTP id 4fb4d7f45d1cf-5e4a0d70f8cmr11297401a12.10.1740678216530; Thu, 27 Feb 2025 09:43:36 -0800 (PST)
MIME-Version: 1.0
References: <CAF8qwaA-beSAxmzYsZT_a60M6_vGtbgWKajxiqHJascb944hJg@mail.gmail.com> <186450AF-3697-4BC7-A05F-225B5F7CD62D@vigilsec.com> <CAF8qwaDDiNMkfwY9saNSRLi--h9RKBhVAXHG+SZXQMTG68nuxg@mail.gmail.com> <5e201ad1-4536-4ea9-acbd-d4c983adc5bc@von-Oheimb.de> <CAFR824yJKvsP+tDKYNo2CJaqxN-k=Ty9-WNVnTgNcv6S4ak+1g@mail.gmail.com> <CAJNT1YXsh+NYTtYmx-4PEzq4rvE1f-SVoDZ--kKBeZN_1-HD4g@mail.gmail.com> <55A2C7E8-B47E-4A51-9281-B71E6DF768CC@akamai.com>
In-Reply-To: <55A2C7E8-B47E-4A51-9281-B71E6DF768CC@akamai.com>
From: Andrew Chen <andrew.pkichat@gmail.com>
Date: Thu, 27 Feb 2025 09:43:24 -0800
X-Gm-Features: AQ5f1JqtpBtBR4ORLURJwZvo-ffIy29r2FFBaIrNpatd4_VfavViR7_bhnV8qgE
Message-ID: <CAJNT1YU706dx6oEdvDfXbea+E-CNJvzUAiMCRnOw0Jhq2xe_3Q@mail.gmail.com>
To: "Salz, Rich" <rsalz@akamai.com>
Content-Type: multipart/alternative; boundary="000000000000c3c107062f233a80"
Message-ID-Hash: BF6NATENJTZ64N6BPCNVEOIC3L7VP6JE
X-Message-ID-Hash: BF6NATENJTZ64N6BPCNVEOIC3L7VP6JE
X-MailFrom: andrew.pkichat@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Deirdre Connolly <durumcrustulum@gmail.com>, David von Oheimb <it=40von-Oheimb.de@dmarc.ietf.org>, LAMPS <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: Call for adoption of draft-davidben-x509-alg-none
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/BThs7dSmw8QPI8-n6u1FxtqczS4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

I'm thinking of the eventual future where these supplant self-signed certs.
Someone who stumbles upon one of these (e.g. in sample/example code
included with a software package) should know that they're insecure/unsafe
and not meant for production use.

On Thu, Feb 27, 2025 at 9:27 AM Salz, Rich <rsalz@akamai.com> wrote:

> ZjQcmQRYFpfptBannerEnd
>
> My inclination is to name it -insecure or -unsafe to make the implications
> of using this signature algorithm clear to someone who stumbles upon it.
>
>
>
> How would they stumble upon it?  Most likely they’ll get a PEM (or DER)
> file with the OID that their software does not understand.
>

v2.46.0 | Report a Bug | By Email | System Status