Subject: Re: Comments on draft-ietf-pkix-okid-00.txt

From: [email-masked] (Peter Gutmann)
Date: Fri, 1 Feb 2002 15:04:50 +1300 (NZDT)

[Redirected back to PKIX since there's another thread on this as well]

>>>(Note that all the characters are uppercase and that the characters "0", "1",
>>>"8", and "9" are not used.)
>>
>>Hmm, you still run into confusion over O and I.  I've been using:
>>
>>static const char codeTable[] = \
>>
>>       "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";     /* No O/0, I/1 */
>
>We discussed this in the IDN context. We decided that it wasn't that
>important, but I might change it to your string.

I've checked this with users/developers and it was generally regarded as a Good
Thing.

>>You also probably want to checksum the values to detect users mistyping the ID
>>(which is not that uncommon) rather than the cert not matching.
>
>Disagree. These will be used in environments where there is communication
>between the parties, and the person who got the "wrong" calculation would
>simply go back to the person who sent it and say "this doesn't seem right".
>With a checksum, you go from good/bad to good/bad/mistype, and I think that
>three states are much worse than two.

The masses (or at least the "developers" part of the masses) seem to think
otherwise.  There was a strong demand for a means of checking that the user had
entered a correct value before anything further was done - that's why the code
I sent you had an isUserValue() function, you could feed it an arbitrary string
and it would tell you that what you had was a correctly-formatted key.

>Also, it would mess up the symmetry of the "four sets of four".

The consensus among users/developers was to go with groups of five.  Most users
have been conditioned to this pattern by MS registration codes (which have in
turn been emulated by other vendors), moving to groups of four for this one
case was seen as asking for trouble.

Peter.