Re: [TLS] TLS grammar checker?

[Nico Williams <[e-mail]>]

On Fri, Jun 21, 2013 at 6:33 PM, Martin Rex <[e-mail]> wrote:
> Nico Williams wrote:
>> Automatic tooling is a better start.  I.e., ASN.1, XDR, IDL, ... compilers.
>>
>> Ad-hoc syntaxes don't lend themselves to automatic tooling, so they
>> tend to result in lots of error-prone hand-coding.
>
> Syntax that is so complicated that it needs tooling is a problem by itself.

*All* useful syntax (in this space) is useful because you can you can
build tooling around it.  By definition, then, it requires tooling.

ASN.1 is not easy to parse, but it's not terribly hard either.
There's at least three, maybe four open source compilers.  And there
would have been many more had ASN.1 been *free* back in the 80s.

That's ASN.1's biggest sin: it wasn't free.  If you say it's mostly
unknown, well, that's partly why.

ASN.1's next biggest sin: its crappy initial encoding rules (BER, DER, and CER).

If I could go back in time and do anything about this it'd be: tell
people in the 80s about JSON (with chunked, unescaped string
encoding).

> ASN.1 is squarely part of the problem space, not part of the solution space.

Anything with tooling is in the solution space.  Today I prefer JSON
(see above).

> If you believe you can parse or encode X.509/PKIX just by using an
> ASN.1 compiler tooling, then you probably have never even looked
> at X.509/PKIX.  The devil is in the comments sprinkeled all over the
> place where you have to tweak the compiler output in so many ways and
> so many places that writing everything by yourself becomes quite a
> viable alternative, and one that is free of hidden eastereggs.

These are the results of ASN.1 having been non-free.  The same applies
to Kerberos.

> While there exist a canonical ASN.1 DER encoding, decoding and re-encoding
> Certificates and CRLs may often result in digital signature verification
> failures.

The universal consensus seems to be: don't do that [regardless of
encoding].  This has come up again and again, in the context of ASN.1,
XML, and JSON, and the answer is always: don't bloody do that.

Nico
--