Subject: Certicate Format Independence

From: "Aram Perez" <[email-masked]>
Date: Mon, 12 Jul 1999 09:32:20 -0700

(used to be RE: ASN.1 vs XML (used to be RE: I-D 
ACTION:draft-ietf-pkix-scvp-00.txt)), etc.

Having been beat up over algorithm independence (and maybe the beating isn't
allowing be to think clearly), IETF should support format independence for
certificates.

:-),
Aram Perez

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 12 Jul 1999 14:25:26 -0700

----- Original Message -----
From: Aram Perez <[email-masked]>
To: <[email-masked]>
Sent: Monday, July 12, 1999 9:32 AM
Subject: Certicate Format Independence

> allowing be to think clearly), IETF should support format independence for

Aram, Don't we already have that though?.

The standard is set at the BER/DER encoding of the X.509 data structure
represented in the ASN.1 Structure Standard. Anyone that wants to encode to
the standard represented can chose to do so at either  the source level
structure or  the "resolved" binary cert token, it should be up to their
applications.

There cert structure represents the greatest common denominator between a
number of use models and that's why its the right standard as a crossing
point in PKI systems. This places the level of interoperability of the trust
processes at the data structure of the cert token. By the way, time and
event stamps should be the same way, that is as datastructures rather than
service API's or Protocol Models..

meanwhile back to the rant - So the XML issue is really a question of  "can
I represent the same structures in XML as I can in ASN.1?", and the answer
is obviously "Yes"...

My feeling here is that the stumbling block is that we are getting hung up
on what it is we are standardizing here -  is it the blob of bits as
processed through some encoder or resolver or is it the data structure that
you feed into the resolver... or is it both? These are the questions that
must be answered for this conversation to really make sense and these are
relatively simple questions to answer.

If the standards are about the data structure that represent the entities
(certs) as raw binary, then the fact that they are made human readable by
writing them in ASN.1 is irrelevant to the standard structure except as a
reference notation. It becomes a nicety done purely for the reader's comfort
and nothing more.

If what is being standardized is that the X.509 cert is a ASN.1 represented
structure as processed by a "Standardized" BER or DER compliant encoder,
then we are stuck with ASN.1 and the encoders. But I think that what is
being standardized is a binary token that happens for the use of the
"standards" documents to refer to the data structures in ANS.1 for my
reading ease. Nothing more. That makes the real issue here only one of
whether someone wants to step to the plate and write a binary compiler ala a
DER encoder for XML and the preprocessor/rules process to convert the XML
structures into the appropriate ASN.1 compiled outputs.

Todd