Subject: Re: TSP interop update

From: [email-masked] (Peter Gutmann)
Date: Fri, 18 Jan 2002 16:51:05 +1300 (NZDT)

Joe Morgan <[email-masked]> writes:

>Just a quick update on our progress with TSP interop testing.

Actually this raises an interesting point, the TSP RFC says that extensions are
handled just like RFC 2459 except when they're not.  In particular it says you
should reject all extensions which you don't recognise.  This can be
interpreted to mean anything, at the moment I reject all extensions which don't
seem to make any sense in a request (which means almost all of them), however
taking the interpretation of "recognise" -> "it's valid ASN.1 and has an OID"
then I could just as easily accept any extensions (or ignore them).  What are
other people doing?  I'll probably change the code to follow the "be generous
with ..." rule of thumb, which means I'll ignore extensions.  The RFC doesn't
specify any particular extensions which you have to (MUST/SHALL/SHOULD) handle
and says the critical bit is ignored (in violation of RFC 2459), so it looks
like accepting/ignoring anything that you "recognise" is fine.

Peter.

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Fri, 18 Jan 2002 10:25:10 +0100

Peter Gutmann wrote:

> The RFC doesn't

The text in the RFC sounds a lot more like any extension should be handled as if it
had the critical flag, and the request rejected if you don't know exactly the
meaning of the extension.

---

From: tho <[email-masked]>
Date: Fri, 18 Jan 2002 11:36:00 +0000

Peter Gutmann wrote:
> Actually this raises an interesting point, the TSP RFC says that extensions 
> are handled just like RFC 2459 except when they're not.  In particular it 
> says you should reject all extensions which you don't recognise.  This can be
> interpreted to mean anything, at the moment I reject all extensions which 
> don't seem to make any sense in a request (which means almost all of them), 
> however taking the interpretation of "recognise" -> "it's valid ASN.1 and has
> an OID" then I could just as easily accept any extensions (or ignore them).  
> What are other people doing?  I'll probably change the code to follow the 
> "be generous with ..." rule of thumb, which means I'll ignore extensions.  
> The RFC doesn't specify any particular extensions which you have to 
> (MUST/SHALL/SHOULD) handle and says the critical bit is ignored (in violation
> of RFC 2459), so it looks like accepting/ignoring anything that you 
> "recognise" is fine.

from rfc3161:

   "The extensions field is a generic way to add additional information
    to the request in the future"

this seems to mean that the primary use of the extension field is expanding
the semantics of the tsp protocol. 

so I think that if the TSA doesn't understand the _semantics_ (not the syntax)
of the extension it "SHALL not issue a token and SHALL return a failure
(unacceptedExtension)." 

ciao, tho
--