Re: [stir] I-D Action: draft-ietf-stir-certificates-17.txt

[Russ Housley <[e-mail]>]

> On Dec 14, 2017, at 5:03 PM, Paul Kyzivat <[e-mail]> wrote:
> 
> On 12/14/17 4:19 PM, Russ Housley wrote:
>>> On Dec 14, 2017, at 12:59 PM, Sean Turner <[e-mail]> wrote:
>>> 
>>> Bit to quick in my response, to address the 2nd point:
>>> 
>>>> On Dec 14, 2017, at 11:42, Martin Thomson <[e-mail]> wrote:
>>>> 
>>>> "123"+900 is now equivalent to "123"+876, which means that you have
>>>> two ways to represent the same thing.  Don't we try to avoid that in
>>>> certificates?  (I mean otherwise we'd use BER...)
>>> 
>>> As far encoding something the same way: I’d be worried if “123”+900 and “123”+876 resulted in the same DER code, but it doesn’t.
>> No, this bits on the wire are different, but they specify the same block of telephone numbers.  Why do we want more than one way to specify the same block of numbers?
> 
> I agree that "123"+900 seems like a bad idea.
> 
> But even without that there are multiple ways to specify the same range of numbers: a single range, two or more smaller ranges that collectively cover the range, or a complete list of individual numbers.

To be clear, there is not a security issue here.  "123" + 900 and "123" + 876 specify the same block of numbers.  If a certificate issuer says "123" + 900, do we really want to reject the certificate as badly formed?

Does anyone have language to make "123" + 876 the preferred encoding?

Russ