Subject: [TLS] Duplicate oid_filters

From: Eric Rescorla <[email-masked]>
Date: Fri, 9 Mar 2018 13:35:13 -0800

See issue #1166.

The current text neither allows nor prohibits the same OID appearing twice.
We should do one or the other.

-Ekr

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 9 Mar 2018 15:44:49 -0600

(See also https://github.com/tlswg/tls13-spec/issues/1179)

On 03/09/2018 03:35 PM, Eric Rescorla wrote:
> See issue #1166.
>
> The current text neither allows nor prohibits the same OID appearing
> twice. We should do one or the other.
>

---

From: Andrei Popov <[email-masked]>
Date: Fri, 9 Mar 2018 22:02:31 +0000

It should be OK to restrict to one appearance of the same OID, if there is a desire to do so.

-----Original Message-----
From: TLS <[email-masked]> On Behalf Of Benjamin Kaduk
Sent: Friday, March 9, 2018 1:45 PM
To: <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Duplicate oid_filters

(See also https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftlswg%2Ftls13-spec%2Fissues%2F1179&data=04%7C01%7CAndrei.Popov%40microsoft.com%7Cddb0cb5ca2684dcdf7d708d58607050a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636562287068258523%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-2&sdata=3QfikwA9T0ScU6Yw9T%2Fo3IDhmj1zYgcJzye1sx5M%2Bp0%3D&reserved=0)

> twice. We should do one or the other.

_______________________________________________
TLS mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Ftls&data=04%7C01%7CAndrei.Popov%40microsoft.com%7Cddb0cb5ca2684dcdf7d708d58607050a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636562287068258523%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%3D%7C-2&sdata=ArdtWlWWMO0DfeuREq%2F1ab8vNFhxvhoLW1yWIz089Oc%3D&reserved=0

---

From: Sean Turner <[email-masked]>
Date: Fri, 9 Mar 2018 19:35:09 -0500

Okay so the OIDs can’t appear twice in the certificate, because certificate extensions are only supposed to appear once so why don’t we just follow suit and require no dupes?

spt

> On Mar 9, 2018, at 16:44, Benjamin Kaduk <[email-masked]> wrote:
> 
> https://www.ietf.org/mailman/listinfo/tls

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 10 Mar 2018 17:02:50 +0200

On Fri, Mar 09, 2018 at 07:35:09PM -0500, Sean Turner wrote:
> >> The current text neither allows nor prohibits the same OID
> >> appearing twice. We should do one or the other.
>
> Okay so the OIDs can’t appear twice in the certificate, because
> certificate extensions are only supposed to appear once so why
> don’t we just follow suit and require no dupes?

Duplicate OIDs do not look to be useful either:

- All of currently defined filters have "all of" behavior.
- Duplicate filters would presumably intersect.
- Thus, one can rewrite a filter that has duplicate OIDs with just
  each OID once.

-Ilari