Subject: RE: OIDs as URIs

From: "David P. Kemp" <[email-masked]>
Date: Tue, 28 Nov 2000 11:30:34 -0500 (EST)

From: "Karl Scheibelhofer" <[email-masked]>

> > > it is not human readable.
> >
> > This is not needed either.
> 
> for use in XML i would heavily recommend that it is human readable. as i
> already stated in another message, this was a design goal for XML: "XML
> documents should be human-legible and reasonably clear." i think this
> advantage should not be underestimated.

OIDs are registered by number. The human-readable strings are comments
added for convenience; there may be zero, one, or more strings used
to represent a particular OID arc, and the suggested values for such
strings can be changed if the organization registering them wishes
them changed.

The notation for object identifiers defined in X.680 is a list of
components, where each component can be a NameForm, a NumberForm, or
a NameAndNumberForm:

  * { itu-t(0) identified-organization(4) etsi(0)
   electronic-signature-standard(1733) part1(1) idupMechanism(4) etsiESv1(1) }

  * { 0 4 0 1733 1 4 1 }

  * { itu-t identified-organization etsi(0) 1733 1 4 etsiESv1(1) }

But:

  "The semantics of an object identifier value are defined by reference
   to an object identifier tree. ... Each arc of the tree is labelled
   by an object identifier component which is a numeric value. ... Thus
   an object is uniquely and unambiguously identified by the sequence of
   numeric values labelling the arcs in a path from the root to the vertex
   allocated to the object."

Providing the option for a human-readable XML encoding is a reasonable
goal, but there is a significant risk that XML software will treat the
human-readable portion of the encoding not as a comment but as significant.
This results in a situation where a comparison of two identical OIDs
could give an answer of "not equal".

Any XML encoding of OIDs MUST permit a numeric-only representation, and
MUST ensure that the semantics of OIDs are preserved when non-numeric
representations are used.

---

From: "Karl Scheibelhofer" <[email-masked]>
Date: Wed, 29 Nov 2000 08:30:04 +0100

> -----Original Message-----
> From: David P. Kemp [mailto:[email-masked]]
> Sent: Tuesday, November 28, 2000 5:31 PM
> To: [email-masked]
> Subject: RE: OIDs as URIs
>
>

i agree that a number-only presentation should be supported. i think that is
even necessary, because it it not required for all arcs to have a name. but
it should at least be possible to use a kind of NameAndNumberForm.
personally, i would even avoid the name-only form. it would be quite hard to
get a number-only presentation out of it.
for comparison, it will be necessary to define under what conditions two URI
presentations of OIDs must be considered equivalent.

regards

  Karl

---

From: Rich Salz <[email-masked]>
Date: Wed, 29 Nov 2000 06:51:49 -0500

> it should at least be possible to use a kind of NameAndNumberForm.

Why?  Under what circumstances is "enterprise-mib" better than "2"?
We already know that names will hurt machine processing, and humans can
clearly read numbers.  What is the point of having the name?  Who will
be helped, and what will they do with it?

---

From: "Karl Scheibelhofer" <[email-masked]>
Date: Wed, 29 Nov 2000 13:09:12 +0100

> From: Rich Salz [mailto:[email-masked]]
> Sent: Wednesday, November 29, 2000 12:52 PM
> To: Karl Scheibelhofer
> Cc: [email-masked]
> Subject: Re: OIDs as URIs
>
>

one main reason for expressing OIDs as URIs is that we want to use the
within XML documents. normally one can read a XML document with a text
editor and get a good idea of what it is all about.
if you use pure number OIDs in it, you have normally no idea, what that
means.
try to guess waht 1.3.14.3.2.27 means (without browsing into some
web-directory).
then try to read {iso(1) identified-organization(3) oiw(14) secsig(3)
algorithms(2) sha1(27)}.
i think we do not need discuss, what is easier to read for humans.

regards

  Karl Scheibelhofer

--

Karl Scheibelhofer, <mailto:[email-masked]>
Institute for Applied Information Processing and Communications (IAIK)
at Technical University of Graz, Austria, http://www.iaik.at
Phone: (+43) (316) 873-5540

---

From: Rich Salz <[email-masked]>
Date: Wed, 29 Nov 2000 07:28:34 -0500

> i think we do not need discuss, what is easier to read for humans.

But we do! You picked one example that sort of works.  But it only sort-of
works:
	What's oiw?
	What's secsig?
Out of that entire string, the only useful "word" is SHA1.  So perhaps
	oid:1.3.14.3.2.27#sha-1
where the URI fragment after the # is a comment?

I claim your example is contrived.  You also haven't answered my question --
*how* will the words be used by humans?
	/r$

---

From: Eric Murray <[email-masked]>
Date: Wed, 29 Nov 2000 08:12:57 -0800

> editor and get a good idea of what it is all about.

Given what's happened to HTML in the last 5 years, don't expect that
to last long unless a concerted effort is made in all XML standards
groups to maintain human readability.

> i think we do not need discuss, what is easier to read for humans.

99% of humans won't know what either format means.  Of the remaining
1%, 95% will only understand the string "sha1" and none of the rest.

Most crypto programmers simply get an OID from something else that's
similar (which is why OIDs from obsolete documents keep appearing-
that's what was in the library when the programmer went looking for an
appropriate OID).  Expressing OIDs as URIs instead of numbers won't
fix this or make any more people understand them, it'll just take up
more space.

Also, what happens when you're parsing a string which has
correct numbers but incorrect names?  I.e. your example

iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) sha1(27)

being incorrect:

iso(1) identified-organization(3) junk(14) secsig(3) algorithms(2) sha1(27)

The numbers in the string are correct, but not the names.  Which
is used when you're parsing the OID?  Both?  Just the names?  Just the
numbers?

-- 
  Eric Murray           Consulting Security Architect         SecureDesign LLC
  http://www.securedesignllc.com                            PGP keyid:E03F65E5

---

From: "Phillip H. Griffin" <[email-masked]>
Date: Thu, 30 Nov 2000 04:30:19 -0500

Turns out that even if you're an old geezer that
knows oiw is open implementors workshop, you still
wouldn't have a clue to contact Rob. And if you did
he'd tell you as former registrar that the registry 
has long been closed down.

The numbers are all that a program needs to switch 
off of. Either the application knows what the number
means or it doesn't. Very simple.

Phil

-- 
Phil
----
Phillip H. Griffin      Griffin Consulting
http://asn-1.com        Secure ASN.1 Design & Implementation
+1-919-832-7008         1625 Glenwood Avenue, Five Points
+1-919-832-7390 [fax]   Raleigh, North Carolina  27608  USA
------------------------------------------------------------