[lamps] AD Review of draft-ietf-lamps-samples-05

[Roman Danyliw <[e-mail]>]

Hi!

I performed an AD review of draft-ietf-lamps-samples-05.  Thanks for this helpful contribution to repeatable testing.  I have a few minor editorial comments below.  I'm advancing the document to IETF LC.  Please address them with any other LC feedback you get.

** A few editorial things:

-- Section 1.3.  Typo. s/perl/Perl/

-- Section 3.1.  Typo. s/cerificate/certificate/

-- Section 9.  In the spirit of inclusive language, please use an alternative to "blacklist"

** No issue with the content, but for awareness, in the course of validating the PKCS#12 examples in Sections 7.5 and 8.5, an unexpected issue was found in OpenSSL. To read PKCS12 files with "openssl pkcs12", you can only pass DER input, not PEM (like is provided in the draft).

==[ snip ]==
PS> openssl.exe version
OpenSSL 3.0.0 7 sep 2021 (Library: OpenSSL 3.0.0 7 sep 2021)

PS> openssl.exe pkcs12 -info -in .\lamps\section8-5.txt
CC320000:error:068000A8:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto\asn1\tasn_dec.c:1188:
CC320000:error:0688010A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:crypto\asn1\tasn_dec.c:349:Type=PKCS12
==[ snip ]==

Ben (Kaduk) graciously did a bit of troubleshooting which resulted in this issue: https://github.com/openssl/openssl/issues/16971

To parse the examples in the draft with openssl, one has to do the following:

==[ snip 2 ]==
PS> openssl.exe base64 -d -in .\lamps\section8-5-no-pem-headers.txt -out .\lamps\section8-5-decoded.txt

PS> openssl.exe' pkcs12 -info -in .\lamps\section8-5-decoded.txt
Enter Import Password:
MAC: sha1, Iteration 10240
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 5143
...
==[ snip 2 ]==

Regards,
Roman