Subject: ;binary Concensus?

From: David Chadwick <[email-masked]>
Date: Wed, 10 Apr 2002 22:40:07 +0100

Folks

There has been a lot of discussions on the use of ;binary, and clearly
two opposing view points. One camp think its use is unnecessary, the
other think it should be mandatory. I dont know how rough concensus is
measured by the IETF, but in terms of pure numbers more people voiced
support for unnecessary than for mandatory. But I would not say that a
concensus has been reached by any means, but maybe it was a very rough
concensus (maybe the chairs can comment on this). Anyway, I propose to
use the following text in the revised PKIX ID in the next revision.
Although the issue is not closed, I am not persuaded that ;binary should
be mandatory.

3.3  Certificate Syntax

A value in this transfer syntax is the binary octet string that results
from BER and/or DER-encoding of an X.509 public key certificate.  The
following string states the OID assigned to this syntax:

      ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'A BER and/or DER encoded
public key certificate' )

Servers must preserve values in this syntax exactly as given to them by
the client, when storing and retrieving certificates. 

Note. Due to the changes from X.509(1988) to X.509(1993) and subsequent
changes to the ASN.1 definition to support certificate extensions in
X.509(1997), no character string transfer syntax is defined for
certificates. The BNF notation in RFC 1778 [12] for "User Certificate"
MUST NOT be used. Values in this syntax MUST be transferred as BER
and/or DER encoded octets. The use of the ;binary encoding option, i.e.
by requesting or returning the attributes with descriptions
"userCertificate;binary" or "caCertificate;binary" has no effect on the
transfer syntax.  

David

-- 
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 161 745 8169
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 10 Apr 2002 19:53:20 -0500

At 04:40 PM 2002-04-10, David Chadwick wrote:
>other think it should be mandatory.

While I would not myself describe the "camps" in this manner,
I do agree there is contention and that "camps" appear to be
forming.

>I dont know how rough concensus is measured by the IETF

It's up to the chair(s) to gauge consensus.  At this point,
I gauge the LDAPbis WG has not having consensus in regards
to either the general specification of ;binary in
draft-ietf-ldapbis-protocol-xx.txt nor with the specific use
of ;binary in draft-ietf-pkix-ldap-schema-02.txt.

My current approach for addressing this contention was to see
if the WG can reach consensus regarding the ;binary
specification language of draft-ietf-ldapbis-protocol-xx.txt
and then draft-ietf-pkix-ldap-schema-02.txt to be specified
in a manner consistent with draft-ietf-ldapbis-protocol-xx.txt.
It is, of course, important that the language used to clarify
draft-ietf-ldapbis-protocol-xx.txt preserve the demonstrated
interoperability for LDAPv3 certificate access.

What I would like to see is the those in each camp, operating
as a design camp, offer text which provides a clear and concise
specification of ;binary,  e.g. replacement text for Section
4.1.5 of draft-ietf-ldapbis-protocol-07.txt, for the WG to
consider.

Design Team A will offer replacement text consistent with the
position that ;binary must be used to indicate the transfer
of binary encoded values.

Design Team B will offer replacement text consistent with the
position that the use of ;binary is not necessary to indicate
the transfer of binary encoded values.

These teams are expected small (2-4 persons) and to be short
lived (2-4 weeks).

Those who wish to participate in this work should contact
Bob and I.  Please note which team you would like to be on.
 From the set of volunteers, Bob and I will appoint a team lead
who will edit the text produced by the team.  If the number of
volunteers is too many for the design team to be effective,
Bob and I (with advice from the team lead) will select which
volunteers will serve on the team.  The membership of each
list will be posted as soon as that determination has been
made.

Kurt

---

From: David Chadwick <[email-masked]>
Date: Thu, 11 Apr 2002 12:07:35 +0100

Kurt

I think this is a very good way forward. In particular it is very
important that use of ;binary is clarified in the protocol document. In
a previous message (4 April to Mark) I mentioned 8 cases that need to
clearly covered in the protocol document.

I would like to volunteer to work in either or both of the teams and
leave it up to you to decide in which team or teams I should contribute.

David