Re: [stir] I-D Action: draft-ietf-stir-certificates-17.txt

[Russ Housley <[e-mail]>]

> On Dec 15, 2017, at 6:08 PM, Martin Thomson <[e-mail]> wrote:
> 
> On Fri, Dec 15, 2017 at 3:45 PM, Russ Housley <[e-mail]> wrote:
>> To be clear, there is not a security issue here.  "123" + 900 and "123" + 876 specify the same block of numbers.  If a certificate issuer says "123" + 900, do we really want to reject the certificate as badly formed?
> 
> Yup.
> 
>> Does anyone have language to make "123" + 876 the preferred encoding?
> 
> OLD:
>   count never
>   makes the number increase in length (i.e., a TelephoneNumberRange
>   with TelephoneNumber=10 with a count=91 will address numbers
>   10-99); formally, given the inputs count and TelephoneNumber of
>   length D the end of the TelephoneNumberRange is:
>   MIN(TelephoneNumber + count, 10^D - 1).
> NEW:
>   count MUST NOT make the number increase in length (i.e., a
> TelephoneNumberRange
>   with TelephoneNumber=10 with a count=91 is invalid); formally,
> given the inputs count and TelephoneNumber of
>   length D TelephoneNumber + count MUST be less than 10^D.
> 
> That is, treat "123"+900 the same way you would a range with a
> negative count "123"+(-10).

Note, the ASN.1 syntax requires the count to be an INTEGER greater than 2.

Russ