Subject: [ipcdn] RE: Max Length of X509Certificate in BPI+ MIB

From: Steve Malenfant <[email-masked]>
Date: Mon, 26 Mar 2001 10:05:32 -0800

The current Test Docsis Root CA that we have signed with 2048 bits doesn't
go up to 1000 bytes...  So other certificates shouldn't be bigger, except if
you fill out your organization name with 200 caracters...

It will also depends on the MTU size of the CM... 

Steve
Com21

-----Original Message-----
From: Loukianov, Dmitrii [mailto:[email-masked]]
Sent: Monday, March 26, 2001 10:24 AM
To: 'Kaz Ozawa'; IETF Ipcdn; DOCSIS OSS Mailing List; DOCSIS Security
Mailing List
Subject: RE: Max Length of X509Certificate in BPI+ MIB

Ooops! SNMP works on top of UDP protocol, which does not guarantee that the
packets
will arrive in the order sent. Having the packet split in two will require
modification of the SNMP protocol internals, including out-of-order packet
delivery. 

Therefore it is necessary to reduce the maximum size to fit into
one single PDU, or split certificate into two independent MIBs (not a great
idea).

Dmitrii Loukianov,
Intel. 

-----Original Message-----
From: Kaz Ozawa [mailto:[email-masked]]
Sent: Saturday, March 24, 2001 7:55 PM
To: IETF Ipcdn; DOCSIS OSS Mailing List; DOCSIS Security Mailing List
Subject: Max Length of X509Certificate in BPI+ MIB

The BPI+ MIB draft-ietf-ipcdn-bpiplus-mib-03.txt specifies as follows.

> -- Textual conventions
>
> X509Certificate ::= TEXTUAL-CONVENTION
>      STATUS    current
>      DESCRIPTION
>          "An X509 digital certificate encoded as an ASN.1 DER
>      object."
>      SYNTAX    OCTET STRING (SIZE (0..1487))

1487 octets is the maximum length of the DER encoded digital 
certificate which fits the Auth Request message and Auth Reply 
message. 

Recently, we realized that there are very few SNMP tools which 
(stably) supports this maximum length. Most of the BPI+ MIB 
objects with this X509Certificate syntax are very important for 
both testing and operation. Therefore, we need to request the 
SNMP tool suppliers to support this long string. 

By the way, I heard that the MIB command with 1473 octets or 
longer string does not fit the single PDU and will be divided 
into two PDU. Therefore, changing the maximum length from 1487 
octets to 1472 octets could help the SNMP tool suppliers to 
support the maximum length earlier. I would like to hear any 
opinion on the possibility of this change.

Thanks,
kaz

Kaz Ozawa
Toshiba Visiting Engineer at CableLabs
(303) 661-3860 (direct); -9199 (fax) 
[email-masked] / [email-masked]

_______________________________________________
IPCDN mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/ipcdn

---

From: "Kaz Ozawa" <[email-masked]>
Date: Fri, 30 Mar 2001 08:07:05 -0700

I would like to hear more feedback to make sure the following points.
(1) 1487 octets, the current maximum length of X509Certificate in
BPI+ MIB cannot fit in the single UDP packet.
(2) If we change the maximum length from 1487 octets to 1472 octets,
it fits in the single UDP packet.
(3) If the long MIB data is spited into two UDP packets, CMTS/CM
vendors need to implement extra protocol to handle the special case
in which the order of two UDP packets is switched or one of them is
missed. (Dmitrii's point)
(4) The new maximum length 1472 octets is enough for DOCSIS Certificates.
If all of the above points are correct, we should change the maximum
length to 1472 octets.
I will very much appreciate your review and feedback.

Thanks,
kaz

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Steve Malenfant
> Sent: Monday, March 26, 2001 11:06 AM
> To: 'Loukianov, Dmitrii'; 'Kaz Ozawa'; IETF Ipcdn; DOCSIS OSS Mailing
> List; DOCSIS Security Mailing List
> Subject: [ipcdn] RE: Max Length of X509Certificate in BPI+ MIB
>
>