Subject: Re: [TLS] TLS grammar checker?

From: Peter Gutmann <[email-masked]>
Date: Sat, 22 Jun 2013 00:36:54 +0000

Martin Rex <[email-masked]> writes:

>To illustrate one of my many problems with ASN.1 complexity and lack of
>clarity, I was recently wondering on OCSP [...]

OCSP is a terrible spec, alongside TSP and CMP they're some of the worst
examples of ASN.1 that I know of.

OK, not quite, there are telecomms management specs that are even closer to
gibberish in terms of their ASN.1, the problem with the three above is that
not only is the ASN.1 a mess - some of the authors didn't actually understand
ASN.1 when they started work on it and just made it up as they went along -
but the text is awfully confused as well, as are some of the design features,
which were cargo-cult cut&pastes from other specs without the authors
understanding why they were doing it.  See for example my analysis of CMP in
"Plug-and-Play PKI: A PKI your Mother can Use",
http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix03.pdf, for the specific case
of CMP.  I also have comments on the gibberish nature of parts TSP, posted to
the PKIX list while it was still in the draft stage (nothing was ever fixed),
http://www.imc.org/ietf-pkix/old-archive-01/msg02073.html.

(Apologies for the treasure-hunt URL refs, I'm trying to avoid quoting large
chunks of text for people who don't really care that much).

OCSP is just as bad.  So using these as examples of why ASN.1 sucks is a bit
disingenuous, you'd be hard-put to find worse examples of ASN.1 (and protocol
specs in general) than those.  If you want an example of well-designed ASN.1,
go for something like PKCS #15.

Now, can we switch to vi vs. emacs?  There's a whole lot of things there that
haven't been said yet.

Peter.

---

From: Nico Williams <[email-masked]>
Date: Fri, 21 Jun 2013 21:41:26 -0500

> Now, can we switch to vi vs. emacs?  There's a whole lot of things there that

Neither: VIM, probably the next version, the one that replaces vim's
scripting language with Python.

Also: Amiga over Atari.

I don't care about ASN.1 but don't throw the baby out with the bath
water: just no more ad-hoc crap.  Martin may love the TLS syntax, but
being informal mates it easy to make mistakes and hard to build
tooling.  If we must have ad-hoc syntaxes I'd rather use SSH's ad-hoc
syntax than TLS' (if yer gonna go simple, with be shy, go alll the
way).  But really, going forward we should use JSON -- a trivial JSON
schema language (wherein schemas look as much as possible [without
losing too much expressive power] like the data they describe).

Nico
--