IETF Logo Mail Archive

Re: [lamps] draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)

Tomas Gustavsson <tomas.gustavsson@primekey.com> Tue, 03 August 2021 06:19 UTC

Return-Path: <tomas.gustavsson@primekey.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA11B3A1514 for <spasm@ietfa.amsl.com>; Mon, 2 Aug 2021 23:19:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.8
X-Spam-Level:
X-Spam-Status: No, score=-1.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=keyfactorinc.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rEQiNA0KgMvm for <spasm@ietfa.amsl.com>; Mon, 2 Aug 2021 23:19:31 -0700 (PDT)
Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2100.outbound.protection.outlook.com [40.107.243.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFF4B3A150A for <spasm@ietf.org>; Mon, 2 Aug 2021 23:19:29 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DNJYo8u+ujWCw1GxG2P2zKZPqAFZI+Wbv16LiOzj9KBQ8M+DspcvLJQk1/Lr1RqlVzjZr1uXUtdnfNfkFdmKE2PWvB4p/o9eePEjCHQSamHTYfZSURa0HZ8DLWPz0cC3I0I3CmVzl0zTGEb+3Rsx3gn3cED/eHtPGZ2eeTNrHpGcYcmRMJsrjUX5Hpcza7k+N7ujzvyjh9bf1b074o9RdcHqdO//oUykkuP5j3WG3b7vtXvKVh7jQL8EzF5hgF9wr5WwRft7AU97/hs0rLRrkWQsF7mmF6uz/o9H7eC5wEr+9Hxf+dNZ/26qH0z5TAD3pwpMUEc+2cuZnxWvDt3Heg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jSrDgDJz2UxwazvpKoeSfb6IO4OyQ/8hwsox6plbv/E=; b=gEWTP/r2kQNjvNW2lEKXm6gdiI2DZtetjIdkinmcp2z7m42FcJpAGnp/BXcavmSb/gjYGKqOcTIRN2Za+sDJYCeiCw4LQBnZgDvhRNGj7lN7lni6j2rji8D4G6M2cq8U3aKXG3y1WeFE/KEOttY5hquBFszPxE18+KyPsEWMPYJm4yWKqm8iEw3BOeTlfRhShgjupt4QzvxxdeWiK8Xv0psWKcXxZMysGq5YapEmbofB37JziQhO0zXpQTTxGV+971GEHtQWB8ECrh5HhnLjxLas18L282DdWyz7eS2U0oKw0AbW5iFLlEJXL9nt138DbiP9QRh93VaQmvusI6dbmA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=primekey.com; dmarc=pass action=none header.from=primekey.com; dkim=pass header.d=primekey.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=KeyfactorInc.onmicrosoft.com; s=selector1-KeyfactorInc-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jSrDgDJz2UxwazvpKoeSfb6IO4OyQ/8hwsox6plbv/E=; b=RUs6NhpOsvtribFUFj03TM45wF1D9uKw0QvylfaqJbAGoV4HlBCzKp0tefyHG1UiWg4tkxyNgtAVgh7bO/f4WlQrwPQJBovYnmzTWUqLyG7o4+2G+xPHqWscszRuxHR3S/BW1GHH8unAGsAkNqfE533eJxq6PXIOQTrI7WRqCpw=
Received: from SJ0PR22MB2542.namprd22.prod.outlook.com (2603:10b6:a03:328::8) by SJ0PR22MB2448.namprd22.prod.outlook.com (2603:10b6:a03:31b::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18; Tue, 3 Aug 2021 06:19:27 +0000
Received: from SJ0PR22MB2542.namprd22.prod.outlook.com ([fe80::6c9e:2236:c241:afbc]) by SJ0PR22MB2542.namprd22.prod.outlook.com ([fe80::6c9e:2236:c241:afbc%9]) with mapi id 15.20.4373.026; Tue, 3 Aug 2021 06:19:26 +0000
From: Tomas Gustavsson <tomas.gustavsson@primekey.com>
To: Deb Cooley <debcooley1@gmail.com>, Ryan Sleevi <ryan-ietf@sleevi.com>
CC: LAMPS WG <spasm@ietf.org>, Michael Richardson <mcr+ietf@sandelman.ca>, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Thread-Topic: [lamps] draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)
Thread-Index: AQHXhM/lzlN31evWD0WC3Bg687N/eatbnMqAgADw7ICAAU3ZAIABR6QAgAA0LYCAAQ44AIAA6/xn
Date: Tue, 03 Aug 2021 06:19:26 +0000
Message-ID: <SJ0PR22MB2542E1C2F5C08D9AF5024545E8F09@SJ0PR22MB2542.namprd22.prod.outlook.com>
References: <87czr0ww0d.fsf@fifthhorseman.net> <FF939B28-528B-47F9-9C0C-6585D1B02FBE@vigilsec.com> <87mtq3ukk0.fsf@fifthhorseman.net> <CAErg=HHQMZ1jk+bVxA=MzVvW+9ucie7bu-N6O8Asnp0V8Rf9Bg@mail.gmail.com> <30546.1627850836@localhost> <CAErg=HHKL-E5yT0UnPKcLfMQU41iDg7GGgjsSXs3eRg8daJRkg@mail.gmail.com>, <CAGgd1OfK4rhok5Je0A4VVcuFfTX2PZSRswGyrL=uxGth-UkVRA@mail.gmail.com>
In-Reply-To: <CAGgd1OfK4rhok5Je0A4VVcuFfTX2PZSRswGyrL=uxGth-UkVRA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=primekey.com;
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 06706d2d-5707-48f5-cdfb-08d95646a53d
x-ms-traffictypediagnostic: SJ0PR22MB2448:
x-microsoft-antispam-prvs: <SJ0PR22MB24488860F1685B9B72705ADBE8F09@SJ0PR22MB2448.namprd22.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: SQ3au3vynI22KR1722dEEz+Odi0i3nMwfXTamgUz/E3wTBDRyFgO7Fwt+LWUvxeuKx606tS88J+ikmXV7nw+csg4PA0R0ieccD4+F7sMMFvo6lXmwFp6qHqr0NtUiG3OHJTyTfexsgSBWoYrbWXdcPRa8BFVni/nrXpBr81fFhZEhyM67SfS42AqMvDN9PPQLx0VbbL2OMr+zpMPdimnsfSdQ21b6FHHgat9qcEy5uBRPhaOftV61vw0CDp30GUy697TWhHzh+iD94D5b2Hc6dSqsZe1VxLAQB8jy7/nXqArd4Nws3y1fHK1VjdTp29n1i4sXx2pK50LO6y+JiQJ0VP55S7P5Qw2bVXMxPkZ31Pj+xlq/bfgP9chNXBfPxFg74BQWS0rNs6Q2qORjDWKurUxhvIiMcLrrFORTWqXs5Ms4hixnmG0sYwxoChWGYE8VW6Qhgb21sGxEF7uaFauOgQV1HdcYv59hrvl8F32RI7JCdzdvIUMLAOhx6X7XBO9fnnB7L0+1Ksv3SZcvcH6LzY0Pi3b3FY4OJpdNi1bQ83ev9sZEBm6PPlN+7p6o5RZRB944cwAF9uoAvpaCoEXNh60D3VRTihQm14Oc/L51+EHrZkZ2dAp95wVPf3VIRVykbJ5491TpzSkfjU81ucoKtfZUMeUCgmX45mDYx/D++HhWl+pbYG9/QkZEZnPogi3CscSoO86v4gRWTJsUgTZwaML2umod0RcAoZAo8ErpbTWMfndH9xUu2y/APuiy8FHk/ADrU2mCWPvagBA6EWRlllcsLMlEdOQByTZwXiKQ3w=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SJ0PR22MB2542.namprd22.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(396003)(346002)(39850400004)(136003)(366004)(54906003)(316002)(38070700005)(71200400001)(478600001)(33656002)(7696005)(86362001)(66556008)(110136005)(4326008)(66446008)(64756008)(52536014)(38100700002)(44832011)(19627405001)(66476007)(66946007)(6506007)(122000001)(5660300002)(2906002)(186003)(55016002)(8676002)(53546011)(26005)(966005)(8936002)(83380400001)(9686003)(91956017)(76116006)(166002); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: O4Eatxj6+EldcT8ILXYKVEojfd33jIeBZ0rLZ8euCiwQddtFaUx5b1mrCVwNRPsoNIoC0gQLB7WjH8RNIlL0IJHVSM9BgIx+vGIm386jIqa4oMp6RsU4Wd11cEFRNBOv9+bjjZnws21SyK3YcjMWqPcWw0FThbrH1oA476X5mJA4gHMGhx2hhAOVApac9DwennK5AoLqrh6vGus3BxXJDXNTjpiOJT9+SCRz+lX23L/2L0I3iKcA+X0MsJlMCgnboF9VeWXEJTT4OtxXz41hP4yB1WC/j+JpmG9S8ZpCAM6v7JCnjUFTW8Fhjs4N3cUOyyIdHA3l9C0xjKw6Qx8cLbsLTUqebm5Y6RQnBwmqGpgl+7nAWiyNatDW9at1sTltiMY1Gep7g1UUSK33M79CY7zfirIr3ui53sjwHgoqlND15unUudAmkSdsZvDTenyGc93bZD8gL1e6ubofEqUXvTCeJAikP7e2QoYdA+rvb2SRnYWWaFIG+Vu6yyMIUMjtCVCvydKU9pOElTwX9dI6sXcLxrXjMWJqzAaff/QE5wX2IlTzKrDFF/YWuRbVNBuh4v0hp4sxLxrMhNAEdmfBInG7kKVS1LxWb8uyiCLtZMBIHPE+BlPINhaK35A4jYfQ0ZeXDL8D+1e9Qt+XLdp8WGj/eObKS5liujIx8TZEuRlcCwH6Bq4fFsxVgE4D0ld7rX02anF2bWjyqCOwXd84TderYN/T/IiKy+hQ1qp2VcpuMENwqw6htCRU3kNjSX9C8448XEwOa7UhsRZ039tVEoKu5QClUDLKd4Fod0W1dd+iQmbX/du2xHERyNJR0x4hYOfpZ59e3wxJuGnENq2CIU3OfvDPXdcuXVuVdDDjIsK9yjUEhadhWsVAe2TprLykgeGY6DKs/1b/qbum3vVCajIuSrMrjSBa58IFhm4XrWR8NL4ByDqay92tMNX4kV9iigcrCoblmJdnTdU3hAb/eAoMjFO8H7pROX+LPQOGfriRwnEu77TH+eC5Y3fj2Csb2dR+VcYkpwiMoQpBTCTVBXMXA1QWQ+w9BARcGLyACYDLDVRoD14KY21aJOLTqn+CrFhaEiZbxDbfe8vgrCmj1Jjmteq2ZvZfbAKSoYFbSnxiC+MiGjuBKVMlUoXTk8kvCG7ubWLlAiiAlWIJoOVyhM3bN7Eb/NrNZMiFpzU7bFZeC1zeYKvhPwBhPkzEIYBPbYZH04BV3w6fuAhWSVgGKtTmM62imkjUzskQA2P5QLmC9UaRHP+aY3U1/0mc6QH/IXfKemfzFE9PCF4CAcFY3QNfBICgz50z2G8lXjjJ8h5464uh3ZetVsFOCWw5I2cO
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_SJ0PR22MB2542E1C2F5C08D9AF5024545E8F09SJ0PR22MB2542namp_"
MIME-Version: 1.0
X-OriginatorOrg: primekey.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR22MB2542.namprd22.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 06706d2d-5707-48f5-cdfb-08d95646a53d
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Aug 2021 06:19:26.8381 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c9ed4b45-9f70-418a-aa58-f04c80848ca9
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: dJKEoedeHqWw4ZB6AYjtxCQPaUyhMF8t5mqLGHQ/pf2bE+X8sd+GwWSnnCxFQGlqUEyMtY9utciI7AmeJNdsqnOOt4FavaLog0i/Bf4Hnu4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR22MB2448
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/lggeD1uDxZ6k-Gy-rzIrBEbn8qw>
Subject: Re: [lamps] draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Aug 2021 06:19:36 -0000

> Indeed - use PKCS#7.  Why are we importing keys and certs in this day and age???

Is there another way to use client keys and certificates in browsers (all browsers) and email clients, apart from using hardware tokens or MS autoenrollment, or another 3rd party softare doing the import for you?
Is there a sample of a CMS (PKCS#7) file with certs and private keys that can be imported in browsers? I'd love to try that.
________________________________
From: Spasm <spasm-bounces@ietf.org> on behalf of Deb Cooley <debcooley1@gmail.com>
Sent: Monday, August 2, 2021 6:01 PM
To: Ryan Sleevi <ryan-ietf@sleevi.com>
Cc: LAMPS WG <spasm@ietf.org>; Michael Richardson <mcr+ietf@sandelman.ca>; Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Subject: Re: [lamps] draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)

CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email InfoSec@keyfactor.com with any questions.

Indeed - use PKCS#7.  Why are we importing keys and certs in this day and age???

As for definite length over indefinite length encode - DER for the win.  I agree w/ Ryan.

Updates to PKCS#12?  yuck.

As for RC2.... I'm sure 3keyTDES is better.  LOL  (note:  that was sarcasm)

Deb Cooley
decoole@nsa.gov<mailto:decoole@nsa.gov>

On Sun, Aug 1, 2021 at 7:54 PM Ryan Sleevi <ryan-ietf@sleevi.com<mailto:ryan-ietf@sleevi.com>> wrote:


On Sun, Aug 1, 2021 at 4:47 PM Michael Richardson <mcr+ietf@sandelman.ca<mailto:mcr%2Bietf@sandelman.ca>> wrote:

What should we replace pkcs12 with?

It seems to be the only way to get client certificates into Firefox, Chrome and
Java/Tomcat's keystore.
(I hate it)

What? No, that's not true.

PKCS#7 is widely supported and avoids the "many forms" of PKCS#12's silliness. Or just import directly (e.g. PEM and PKCS#8).
_______________________________________________
Spasm mailing list
Spasm@ietf.org<mailto:Spasm@ietf.org>
https://www.ietf.org/mailman/listinfo/spasm<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C9e036c9936074230baa308d955cedf7a%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637635169285960046%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2Fpge1jL8RtUWgPh8MQYs1%2Fl%2BY8X1LNlBCCqz0k18GZY%3D&reserved=0>

v2.23.0 | Report a Bug | By Email