Re: [lamps] AD Review of draft-ietf-lamps-samples-05

[Daniel Kahn Gillmor <[e-mail]>]

Thanks for this review, Roman and Ben!

On Fri 2021-11-05 02:40:45 +0000, Roman Danyliw wrote:
> I performed an AD review of draft-ietf-lamps-samples-05.  Thanks for this helpful contribution to repeatable testing.  I have a few minor editorial comments below.  I'm advancing the document to IETF LC.  Please address them with any other LC feedback you get.
>
> ** A few editorial things:
>
> -- Section 1.3.  Typo. s/perl/Perl/
>
> -- Section 3.1.  Typo. s/cerificate/certificate/
>
> -- Section 9.  In the spirit of inclusive language, please use an alternative to "blacklist"

I've addressed these changes in git, and can produce a new draft with
these corrections whenever would be useful:

  https://gitlab.com/dkg/lamps-samples

> ** No issue with the content, but for awareness, in the course of validating the PKCS#12 examples in Sections 7.5 and 8.5, an unexpected issue was found in OpenSSL. To read PKCS12 files with "openssl pkcs12", you can only pass DER input, not PEM (like is provided in the draft).
>
> ==[ snip ]==
> PS> openssl.exe version
> OpenSSL 3.0.0 7 sep 2021 (Library: OpenSSL 3.0.0 7 sep 2021)
>
> PS> openssl.exe pkcs12 -info -in .\lamps\section8-5.txt
> CC320000:error:068000A8:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto\asn1\tasn_dec.c:1188:
> CC320000:error:0688010A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:crypto\asn1\tasn_dec.c:349:Type=PKCS12
> ==[ snip ]==
>
> Ben (Kaduk) graciously did a bit of troubleshooting which resulted in this issue: https://github.com/openssl/openssl/issues/16971

Thanks for identifying this concern with OpenSSL.  I agree that the
toolkit should support -inform PEM for the pkcs12 subcommand.

        --dkg