Subject: Re: New test TSA available

From: [email-masked] (Peter Gutmann)
Date: Thu, 23 Aug 2001 07:20:10 +1200 (NZST)

tho <[email-masked]> writes:
>Peter Gutmann wrote:
>>>since the encapsulated content type is set to id-data, version
>>>field in SignedData is (`correctly' since (A)) set to 1 and not to 3
>> 
>>This one's deliberate, since CMS implementations are split 50/50 between
>>ones which ignore the version entirely and ones which require it to be
>>what PKCS #7 set it to, I always use the PKCS #7 version value because
>>that means it'll work with everything.
>
>i see the point, i also understand that version choice in SignedData is 
>somewhat a minor issue, but it would be nice if we all stick to cms rfc 
>rather than develop something broken just to permit interoperability with 
>other broken implementations

It's really a pragmatic decision, if I do what the RFC says I'll get
10,000 users complaining that my code is broken because $RANDOM_IMPLEMENTATION
doesn't work with it, if I ignore what the RFC says I'll get one person on a
mailing list :-) saying it's not right.  I'll accept the latter as less
painful.

(Obviously you can never do this for something critical like crypto-related 
 information, but for something as minor as a version number I doubt I'll be 
 going to hell for it).

>the former should be read taking into account the fact that the number of 
>tsp client at present is still rather small and developers are surely in 
>time to fix their bugs  :)) 

The problem is that my code (and I assume a lot of other code as well)
isn't only a TSA implementation, it's TSA built using generic PKCS #7/
CMS code, which means that "fixing" the TSA would require fixing an
arbitrarily large number of PKCS #7/CMS implementations.  I really have no
strong opinion either way, I'm just pointing out that the situation isn't
as straightforward as it seems.

Peter.

---

From: Alfonso De Gregorio <[email-masked]>
Date: Thu, 23 Aug 2001 10:18:50 +0200

> >other broken implementations

Hi Peter,

>  information, but for something as minor as a version number I doubt I'll be 

<playful argument>
AFAIK, while IETF partecipants meet each other three times a year,
while they work via mailing list, while they send comments on proposed 
standards, they are trying to achive interoperability hopefully by 
_standardization_ :-) 

Does IETF WGs still make sense if we prefer to be not completelly compliant
with RFCs? :-)
</playful argument>

alfonso