Subject: RE: ASN.1 vs XML (used to be RE: I-D ACTION:draft-ietf-pkix-scvp- 00.txt)

From: Michael Myers <[email-masked]>
Date: Sun, 11 Jul 1999 15:32:25 -0700

Tim,

I must strongly disagree.  Doubtless this will come up in various fora this
week.  In my opinion, we should build on what we've managed to accomplish
rather than reinvent it.

Mike

> -----Original Message-----
> From: Timothy Fisher [mailto:[email-masked]]
> Sent: Friday, July 09, 1999 8:11 AM
> To: Ambarish Malpani
> Cc: 'PKIX-List'
> Subject: Re: ASN.1 vs XML (used to be RE: I-D
> ACTION:draft-ietf-pkix-scvp-00.txt)
> 
> 
> I think it would be a very smart idea to move the Certificate encoding
> mechanism from ASN.1 to XML.   ASN.1 has always been the 
> down-side of X.509
> certificates.  XML would be a great improvement.
> 
> Tim
> Cyclone Software
> 
> Ambarish Malpani wrote:
> 
> > Can we please change the subject on this discussion?
> >
> > Thanks,
> > Ambarish
> >
> > 
> ---------------------------------------------------------------------
> > Ambarish Malpani
> > Architect                                                
> 650.567.5457
> > ValiCert, Inc.                                  
> [email-masked]
> > 1215 Terra Bella Ave.                        http://www.valicert.com
> > Mountain View, CA 94043-1833
> >
> > > -----Original Message-----
> > > From: [email-masked]
> > > [mailto:[email-masked]]
> > > Sent: Thursday, July 08, 1999 3:56 PM
> > > To: Anders Rundgren; PKIX-List; Stephen Kent;
> > > [email-masked]; William Z Pope
> > > Subject: Re: I-D ACTION:draft-ietf-pkix-scvp-00.txt
> > >
> > >
> > >
> > > ----- Original Message -----
> > > From: Anders Rundgren <[email-masked]>
> > > To: PKIX-List <[email-masked]>; Stephen Kent 
> <[email-masked]>;
> > > [email-masked]
> > > <[email-masked]>; William Z
> > > Pope <[email-masked]>
> > > Sent: Thursday, July 08, 1999 3:31 PM
> > > Subject: Re: I-D ACTION:draft-ietf-pkix-scvp-00.txt
> > >
> > >
> > > > Well,
> > > > sorry for bringing this up.  For certificates with huge
> > > informational
> > > contents I
> > > > see some gain by wrapping an XML information object 
> into ASN.1 X509
> > > > wrapper.  If PKI goes big, certificates proliferate the
> > > decoding part (RP
> > > debugging)
> > > > will be helped by using XML rather than ASN.1.  
> Particularly if XML
> > > becomes
> > > > the lingua franca of the Web.   But of course XML is not
> > > required, it is
> > > just
> > > > something that could be worth considering for lets say X509.v4
> > >
> > > Actually if that is your intent,  I would think that the real
> > > win here is
> > > having a number of different cert representation formats 
> that include
> > > ASN.1/BER-DER, Binary, XML, and SMIME, myself.
> > >
> > > and have the approved Cert Management Protocols support these
> > > inter-deployment interoperability issues directly.
> > >
> > > Todd.
> > >
> > >
> > >
> > >
>

---

From: Daniel Finkelstein <[email-masked]>
Date: Sun, 11 Jul 1999 19:57:03 -0400

Michael Myers wrote:

Tim,

I must strongly disagree.  Doubtless this will come up in various
fora this

week.  In my opinion, we should build on what we've managed to
accomplish

rather than reinvent it.

Mike

I agree with you, Mike. I don't see harm, however, in pursuing (tangentially)
XML implementation so long as it doesn't distract from continued development
along ASN.1. Arguably XML is a technology that will be important to each
of us, but in such a young state as it is -- still volatile drafts -- it
seems like we'd be playing catch-up constantly with XML standards as they
appear, and then have to figure out PKIX directions based on the new directions
of XML.

At least with ASN.1 we have a solid definition to work with and a good
understanding of it in the development community.

--
Daniel Alex Finkelstein
New Technologies
phone   212-383-2951
pager   917-427-1630
fax     212-383-3289
Securities Industry Automation Corporation

---

From: Timothy Fisher <[email-masked]>
Date: Sun, 11 Jul 1999 23:05:49 -0700

Mike,

I do understand the reluctance to "reinvent" the certificate encoding scheme,
and realize that realisticly we are probably stuck with ASN.1 and DER
encodings.  My point is probably more of an academic one at this point.  Many
people trying to learn how to manipulate and parse certificates themselves
always find ASN.1 and DER to be a big hurdle.  I have heard it complained about
on many occasions.  XML is a very easy to use and very flexible encoding scheme
that would be ideal for certificates and other security data structures.

I would go further than to encode the ASN.1 data in XML as some are suggesting
in this thread.  I would say the ideal solution would be to "reinvent"
certificate encodings in pure XML and get rid of ASN.1 altogether.  Now having
said that, I do understand the difficultly in doing so since ASN.1 is already
well established.

Tim

---

From: Timothy Fisher <[email-masked]>
Date: Sun, 11 Jul 1999 23:08:21 -0700

I certainly am not suggesting that work on ASN.1 be abandoned either.
That is certainly where certificates are "today".   BUT, I do think that
tangential work in defining security structures in XML would have
value.  I do not limit this to certificates either.

Timothy Fisher
Cyclone Software

Daniel Finkelstein wrote:

> I agree with you, Mike. I don't see harm, however, in pursuing
> (tangentially) XML implementation so long as it doesn't distract from
> continued development along ASN.1. Arguably XML is a technology that
> will be important to each of us, but in such a young state as it is --
> still volatile drafts -- it seems like we'd be playing catch-up
> constantly with XML standards as they appear, and then have to figure
> out PKIX directions based on the new directions of XML.
>

---

From: Rich Salz <[email-masked]>
Date: Mon, 12 Jul 1999 08:00:48 -0400 (EDT)

I am often disappointedly surprised by how one comment coming out of left
field from someone with no obvious participatory history can throw an
IETF WG mailing list into a complete spinout.
	/r$

---

From: Daniel Finkelstein <[email-masked]>
Date: Mon, 12 Jul 1999 08:43:39 -0400

Rich Salz wrote:

I am often disappointedly surprised by how one comment
coming out of left

field from someone with no obvious participatory history can throw
an

/r$

Regardless of one's stature either academically or on this list, everyone
should be heard. Just because someone may not have a reputation as great
as someone else does not negate his argument. That's one of the great fallacies:
if Plato thinks this is a good book, it is therefore a good book.

Personally I think it's to his credit, to whomever you refer, that he
should bring up a topic so deeply important the list participants have
responded in such volume. Let's keep the flame wars to the historical past
of USENET; we have too much important work here to do.

---

From: Timothy Fisher <[email-masked]>
Date: Mon, 12 Jul 1999 08:57:40 -0700

One of the tasks of a working group should be to solicit and consider new
ideas I believe.

Tim

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Mon, 12 Jul 1999 16:10:00 -0400

> IETF WG mailing list into a complete spinout.

Thats the Internet for you, bringing people together is going to cut down on
wars y' know.

I thought the original comment quite sensible. Paul and Ambarish essentially
propose redoing the syntax of OCSP and moving away from ASN.1. Kind of funny
that given that a year ago we had a big argument with everyone demanding
that
OCSP be ASN.1.

Having had the argument once and lost it we are no longer where we were. We
have now got an OCSP RFC and much as I like nice syntax I don't see the need
to reopen the discussion.

95% of the complaints about ASN.1 are really only valid against DER which is
based on a theological belief in canonicalization I believe to be completely
bogus. Switch to BER encoding and most of the problems simply vanish.

Only to do so would break everything...

Before folk get too engrossed with XML please remember that it is only a
version
of SGML with (some of) the lossage taken out. The purpose of XML was to
enable
folk like Dave Ragget and myself to hack on the HTML DTD without needing to
wear a clothespeg on the nose at the time. If folk think DER is bad, try
using
strict SGML.

The idea of XML is to provide a tool to help solve some interesting new
problems.
I don't see how re-solving our existing solutions in the XML framework is
necessary or usefull. There are plenty of new problems to address first.

		Phill

---

From: Ben Laurie <[email-masked]>
Date: Mon, 12 Jul 1999 21:27:55 +0100

> Only to do so would break everything...

??? Why? Switching to BER is just relaxing the rules.

> necessary or usefull. There are plenty of new problems to address first.

You could do everything you do with DTD/XML using ASN.1/DER. So, why
don't you?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi