Subject: Re: WAP X.509 Certificate profile specification

From: 王文正 <[email-masked]>
Date: Sat, 4 Nov 2000 14:24:15 +0800

Hi Magnus,

I've downloaded the WAP X.509 certificate profile specification, and noticed
that there is a recommendation on the length of Certificate Serial Number:

6.2.1 Certificate Serial Number
CAs claiming conformance with this specification should avoid using
serial numbers longer than 8 bytes (63 bits, topmost bit cannot be set to
1).

I believe that the recommendation is due to the limit memory space and
processing power of WAP device. However, I suggest that the specification
should extend the limitation on the length of certificate serial numbers
from
8 bytes to at least 16 bytes, since there are many root CA's and
intermediate
CA's are currently usning 16-byte certificate serial numbers. By allowing
merely more 8 bytes be used for certificate serial numbers, existing CA's
may issue WAP-compliant certificates without changing their algorithms for
generating certificate serial numbers.

--
Wen-Cheng Wang
Telecommunication Lab.
Chunghwa Telecom Co., Ltd.

On Mon, 30 Oct 2000, Magnus Nystrom wrote:
> Hi Tom,
>
> I would suggest that you send them directly to me, unless they are
> pkix-related. I will make sure to forward them to WAP's security group
> mailing list - and Cc: you.
>
> Thanks,
> -- Magnus
>
> On Mon, 30 Oct 2000, Tom Arnold wrote:
>
> I've downloaded the document and am beginning to review it.  My company is
> not a member of the Wap Forum...  As such, if I have comments, where
should
> I send them? I'm assuming the PKIX list is not the correct location...
>
> At 04:19 PM 10/26/2000 +0200, you wrote:
> >Dear PKIX members,
> >
> >On behalf of WAP's security group WSG, I would like to inform you that
> >a document named "WAPCert-20000309" can be found at
> >
> >http://www.wapforum.org/what/technical.htm.
> >
> >This document describes X.509 certificate profiles to be used for those
> >cases when X.509-compliant certificates will be sent over-the-air in WAP
> >protocols (or stored locally in WAP clients).
> >
> >An accompanying document, "WAP-217-WPKI-20000303" describes WAP's PKI.
> >
> >Comments and suggestions related to these documents are welcome and
> >solicited.

---

From: Magnus Nystrom <[email-masked]>
Date: Mon, 6 Nov 2000 08:51:51 -0500 (Eastern Standard Time)

Dear Wen Cheng,

Thanks for your comments.

On Sat, 4 Nov 2000, WCWANG wrote:

> processing power of WAP device.

Yes, memory space and bandwidth savings...

> However, I suggest that the specification should extend the limitation
> on the length of certificate serial numbers from 8 bytes to at least
> 16 bytes, since there are many root CA's and intermediate
>
> CA's are currently usning 16-byte certificate serial numbers. By
> allowing merely more 8 bytes be used for certificate serial numbers,
> existing CA's may issue WAP-compliant certificates without changing
> their algorithms for generating certificate serial numbers.

Yes, but note that this is a recommendation (a "SHOULD") for CAs and not a
requirement.

Regards,
-- Magnus