Subject: RE: Should PKIX protocols support XML well?

From: Frank Balluffi <[email-masked]>
Date: Fri, 17 Nov 2000 05:11:42 -0800

Anders,

I disagree. There is no reason why two people could not write ASN.1-based
software:

1. that takes its object identifier values from command-line arguments or an
initialization file, and
2. dynamically agree upon the value of each object identifier before they
commence communication (i.e., not through some central registration process)

ASN.1 does not have a monopoly on hard-coded identifiers!

Yesterday, Peter Lipp made some excellent points, including a discussion
about purity. I like the idea of diversity and am skeptical of anyone
preaching pure anything (i.e., extremism). ASN.1 is a terrific tool for
solving certain problems. So is XML. For example, ASN.1 is very effective at
transmitting RSA public keys over a wire. XML is very effective at
transmitting display-independent data over a wire. I am not implying that
XML can not be effectively used to solve other problems.

Frank

> -----Original Message-----
> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Friday, November 17, 2000 5:32 AM
> To: Stephen Kent
> Cc: Michael Zolotarev; PKIX-List
> Subject: Re: Should PKIX protocols support XML well?
> 
> 
> Here comes a major reason why ASN.1 did not make it as an 
> EDI-replacent
> (unlike) XML.
> 
>         RoleSyntax ::= SEQUENCE {
>                 roleAuthority   [0] GeneralNames OPTIONAL,
>                 roleName        [1] GeneralName
>         }
> 
> 
>       name      id-at-role
>       OID       { id-at 72 }
>       syntax    RoleSyntax
>       values:   Multiple allowed
> 
> I.e. this connection between a structure (in the commercial 
> world defined by customers)
> and an OID is based on an issued (requested) unique OID.  
> There is no other programming
> language in the world that requires such measures.  This is 
> 100% Ok for (a limited set of)
> globally/widly recognizable things but totally useless for 
> doing more or less local definitions.
> 
> A Purchase Order in ASN.1 could require 20 _carefully 
> managed_ OIDs while the same could be achived
> with a _single_ schema (=single registration).
> 
> Note that schemas can _also_ support globally valid 
> definitions with same "precision"
> as OIDs!
> 
> I.e. except for the storage factor there is nothing that 
> would make an XML-cert profile any
> less useful (or less trustworthy) than a X509 ditto.
> 
> Anders
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 17 Nov 2000 15:46:37 +0100

Frank,

> commence communication (i.e., not through some central registration process)

None of these alternatives sound particularly intriguing or fail-proof.

<snip>
> For example, ASN.1 is very effective at
> transmitting display-independent data over a wire.

XML is also when augmented with schemas an excellent way to create customized
data exchange objects like business messages, or to take something closer to
the hart of this community, attributes of a secure attribute container => XML-AC.

Exactlly how this will be carried out will be discussed in the PKIXML WG.

Anders