Subject: [pkix] Text Encodings of PKIX and CMS Structures (-01)

From: Sean Leonard <[email-masked]>
Date: Wed, 18 Jul 2012 12:53:14 -0700

Greetings PKIX:

Simon Josefsson and I have been working on the -01 revision to 
"pkix-textual", currently titled:
Text Encodings of PKIX and CMS Structures

We would like to propose this for adoption as a WG item.

In comparison to the original -00 draft, this revision has several 
changes, including:
- more history
- discussion of interoperability
- inclusion of CMS and PKCS #8/Asymmetric Key types
- ABNF
- addresses certain points made off-list

Some may have some questions, like "why 'X509 CRL' and not 'CRL'" and so 
forth. Hopefully the draft addresses those, but I am also working on a 
compatibility matrix that records what a lot of common implementations 
actually emit or accept (the tests have been done, but need to be put 
into a digestible spreadsheet). Most statements in the draft are based 
on interoperability tests and experience, for maximum compatibility.

Kind regards,

Sean Leonard

***************************************

A new version of I-D, draft-josefsson-pkix-textual-01.txt
has been successfully submitted by Sean Leonard and posted to the
IETF repository.

Filename:	 draft-josefsson-pkix-textual
Revision:	 01
Title:		 Text Encodings of PKIX and CMS Structures
Creation date:	 2012-07-17
WG ID:		 Individual Submission
Number of pages: 14
URL:             http://www.ietf.org/internet-drafts/draft-josefsson-pkix-textual-01.txt
Status:          http://datatracker.ietf.org/doc/draft-josefsson-pkix-textual
Htmlized:        http://tools.ietf.org/html/draft-josefsson-pkix-textual-01
Diff:            http://tools.ietf.org/rfcdiff?url2=draft-josefsson-pkix-textual-01

Abstract:
    This document describes and discuss the text encodings of Public-Key
    Infrastructure using X.509 (PKIX) Certificates, PKIX Certificate
    Revocation Lists (CRLs), PKCS #10 Certification Request Syntax, PKCS
    #7 structures, Cryptographic Message Syntax (CMS), PKCS #8 Private-
    Key Information Syntax, and Attribute Certificates.  The text
    encodings are well-known, are implemented by several applications and
    libraries, and are widely deployed.  This document is intended to
    articulate the de-facto rules that existing implementations operate
    by, and to give recommendations that will promote interoperability
    going forward.

The IETF Secretariat

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 19 Jul 2012 12:06:08 +1000

> draft-josefsson-pkix-textual-01.txt

A curious sample attribute certificate is included in this draft.
It has a validity period of 4 years, but it doesn't start until 3907 -- in 1,895 years time.
It also has a name that embeds an email address inside a common name:
CN="Scott Staller/emailAddress=[email-masked]", O=CSE592, L=Stony Brook, ST=New York, C=US

--
James Manger

---

From: Sean Leonard <[email-masked]>
Date: Wed, 18 Jul 2012 21:25:46 -0700

> CN="Scott Staller/emailAddress=[email-masked]", O=CSE592, L=Stony Brook, ST=New York, C=US

Good eye.

That "attribute certificate" was in the -00 draft. I am not sure where 
it came from; however, if you Google it, you will find some code that is 
probably the source of that data.

The data also has a strange attribute with with type = 2.5.24.72. This 
is probably a typo, as 2.5.24.72 is not assigned to any attribute. 
2.5.4.72 is id-at-role (RoleSyntax) but what is in the data does not 
actually conform to RoleSyntax.

If anyone has a bona-fide attribute certificate that they would like to 
see in the draft (preferably a short-yet-compliant one), let me know.

Sean

---

From: David Chadwick <[email-masked]>
Date: Thu, 19 Jul 2012 08:15:03 +0100

We have lots of X.509 attribute certificates, plus a tool for creating 
your own at

http://sec.cs.kent.ac.uk/permis/downloads/Level1/acm.shtml

regards

David

On 19/07/2012 05:25, Sean Leonard wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix