Subject: Re: ;binary option

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 09 May 2002 08:54:15 -0700

At 02:15 AM 2002-05-09, Chris Harding wrote:
>The two IETF ldapbis ;binary design teams have now reported, and it looks as though the conclusion may be to remove ;binary from the specification.
>
>I've just looked through BLITS, and this does not mention the ;binary option. There are many tests that use certificates, but they all give the attiibute type as userCertificate, cACertificate, etc, rather than userCertificate;binary etc. So there would seem to be no impact on BLITS. Whether there is an impact on how far implementations can pass the BLITS tests may be another matter.
>
>I don't personally see any interoperability issues, provided that it is clear that the requirement is always to use the ;binary encoding for certificates etc. (per section 6.5 of RFC 2252) and that RFC 1778 (LDAP v2), which defines a different encoding, is now officially dead. Kurt, this isn't completely clear from your mail - am I right that this is what is intended?

It decision we make in the core technical specification regarding
;binary will have a significant impact on further standardization
of certificate schema and the WG should consider this in making
its decision regarding the removal of ;binary.  The WG should
consider other uses of ;binary as well.

It should be obvious that the removal of ;binary protocol element
removes capabilities offered by the core specification.  While some
of these capabilities could be subsequently reintroduced as
extensions, some capabilities would be lost.  In particular, as the
removal of ;binary would include the deletion of the absolute
imperative:
   Clients which request that all attributes be returned from
   entries MUST be prepared to receive values in binary [RFC2252].

any extension reintroducing ;binary would have to account for
clients which might not be prepared to receive values in binary
when return of all attributes was requested.

Kurt

---

From: David Chadwick <[email-masked]>
Date: Tue, 14 May 2002 08:04:29 +0100

"Kurt D. Zeilenga" wrote:
> its decision regarding the removal of ;binary.  

The schema for certificates has been removed from the core LDAPbis
documents and is now being progressed in the PKIX group. As one of the
co-editors of the PKIX draft, our intention is to produce specs that
will be compatible with the new LDAPbis specs, and we will endeavor to
limit the impact as far as possible. We are proposing to say that the
native LDAP encoding for certificates is the same transfer encoding as
produced today by ;binary i.e. DER/BER. Thus the values on the line will
be identical to today, but the attribute description will drop the
;binary option. I am glad to hear that this will not impact BLITS
specifications. It might be a good idea for the OpenGroup to
specifically run an LDAP security interoperability day once the new
specs have been finalised.

David

>The WG should

-- 
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 161 745 8169
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************