Subject: Re: I-D ACTION:draft-ietf-pkix-scvp-00.txt

From: [email-masked] (Peter Gutmann)
Date: Wed, 14 Jul 1999 09:28:49 (NZST)

Ben Laurie <[email-masked]>

>Stephen Kent wrote:
>>This seems to be an example of sloppy work, embraced by a developer
>>community which did inadequate testing.  In contrast, folks working in the
>>CA and X.500 product communities, and those who used ASN for various ISO
>>protocols, seem to have been more careful, or have had more time to find an
>>fix errors.  I stand by my comments.

I must have missed this one, hidden as it was among the 1e6 other messages in
this (mostly pointless) thread, or I would have commented on it... the "X.500 
product community" has a really appalling track record in getting things right 
(see also Rose, Marshall, "The Open Book" and various other publications).  I 
posted a message to this list a year or two back in which I took something 
like a dozen random certs off web pages and checked them, and all but one were
invalid for one reason or another.  If this is the result of being careful, I'd
hate to see what being careless is.

>And when Peter Gutmann made that remark, he was certainly not referring to 
>OpenSSL's standards conformance, as it was in the context of checking 
>signatures in OpenSSL.

Exactly.  SSLeay/OpenSSL is one of the more correct implementations out there.

Can we please finally let this XML debate rest?  If anyone really believes XML
is the way to go then do what I suggested in a previous message, rebuild X.500
in XML and let the market decide[0].

Sheesh, now look what you've made me do, I'm agreeing with Alan Lloyd over
something.

Peter (who really didn't want to contribute yet another message to this thing, 
       but doesn't see any hope of the thread dying any time soon.  Could 
	   someone please finally mention Nazis and get it over with?)

[0] That message was intended as sarcasm/silliness BTW, apparently some people 
    took it seriously.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 14 Jul 1999 02:29:26 -0400

peter,

>hate to see what being careless is.

Marshall's book is rather out of date.  My comments were directed at more
recent experience in the area.

Your sample may not be too representative, especially with respect to the
topic at hand.  Do you know what products were used to generate the certs?
if not, then one cannot infer what part of the cert generation process has
gone wrong.  Also, were the errors in question encoding ones, relevant to
this debate, or did they have to do with the data values per se?

Steve