Re: [lamps] WG Last Call for draft-ietf-lamps-pkcs12-pbmac1-02

[Hubert Kario <[e-mail]>]

On Wednesday, 11 October 2023 00:02:41 CEST, David Woodhouse wrote:
> On Tue, 2023-10-10 at 19:26 +0000, Salz, Rich wrote:
>>> Title: Use of Password Based Message Authentication Code 1 (PBMAC1)
>>> in PKCS #12 Syntax
>>> Should the LAMPS WG ask the IESG to publish this document as an
>>> Informational RFC? Please respond to this WG last Call by 24
>>> October 2024.
>> 
>> 
>> Yes. The document is clear and easy to understand and has a nice set
>> of test vectors.
>
> I respectfully disagree that the set of test vectors is 'nice'.
>
> The password for them all is "1234". That's not much of a test.
>
> Ideally the password should contain at least one character outside
> ASCII. And preferably outside the BMP. And maybe something that would
> be represented differently in NFC vs. other normalization forms, for
> extra fun.
>
> Once we start thinking about that... is it actually fully specified?
>
> The draft refers to RFC8018 but RFC8018 itself doesn't specify the
> character set to be used for passwords, does it? It merely hints that
> "ASCII and UTF-8 are two possibilities" ... but are actually one
> because ASCII is a subset of UTF-8.
>
> Does this draft implicitly fall under the auspices of §B.1 of RFC7292,
> which laments that fact about RFC8018, and tells us that "all passwords
> are created from BMPStrings with a NULL[sic] terminator"? If so, could
> it be made *explicit* just for clarity?
>
> And could we specify the normalization while we're at it?

Specified it as "do the same as you do for PBES1 or PBES2":
https://github.com/tomato42/id-pkcs12-pbmac1/pull/4
is that acceptable to you?
-- 
Regards,
Hubert Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic