Subject: RE: ASN.1 vs XML (used to be RE: I-D ACTION:draft-ietf-pkix-scvp-00.txt)

From: Anders Rundgren <[email-masked]>
Date: Mon, 12 Jul 1999 12:58:55 +0200

Peter,
This was fun to read!

Technically you are right although I doubt that XML-certs will be more
than 1.5 - 2 the size of their ASN.1 counterparts which is not THAT bad IMO.

The important thing is that in order to make PKI a main-stream technology (which it is
not today), may require changes like going to XML as XML is likely to
at least replace EDI which is often used in the same contexts as certificates (or
rather should be).  So if XML becomes the HTML (which is closer to a
"peoples movement" than a computer language) of business messages, ASN.1
may be too obscure (few know it) and less satisfactory as a long-term solution.

This should be seen in the light of the fact that the only main-stream PKI-application
I can think about, is e-commerce.  As very few e-commerce standards are ready
for prime time, there is plenty of room for new things.

Anders

<document>
<anotheruselessComment>
<headerordescription>
<WordwideusabilityClassIdentifier>1</<WordwideusabilityClassIdentifier>
<numberofWordsReturnedinText>few</numberofWordsReturnedinText>
</headerordescription>
<content>
<yetanotherflame>
<sentence>
<bigparagraph>This would be ideal for vendors of disks, bandwidth etc. 
Xml is a rather inefficient encoding of largely structured non structured data.
Remember the origins. The environment where xml, html, sgml, script, latex, etc.
was used initialally was to get annotations <highlight>by hand</highlight> to
textual data. It is also popular because it supports the definition by
name paradigm: Just give something a name, and you know what it is. Replace
all the tags in this message by &lt;a1> &lt;a2> and so on....
</bigparagraph>
</sentence>
</yetanotherflame>
<normaltext>
Look at the examples in
<universalressourceidentifier>
http://asf.gils.net/xer/index.html
</universalressourceidentifier>
</normaltext>
</content>
</anotheruselessComment>
<postscript>
<remark><smiley>:-)</smiley></remark>
</postscript>
<signature>PS</signature>
<Zertifikat>untypisch Deutsch</Zertifikat>
</document>

---

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Jul 1999 03:28:07 -0400

Anders,

>for prime time, there is plenty of room for new things.

There seems to be an implication here that mainstream users want to be able
to read the signed data in its native format, and thus XML encoding is
preferable to DER.  But we know this is not true, i.e., whatever has been
signed will be decoded prior to display, and then rendered for the user.
So, it would seem that the use of an encoding scheme such as XML would be
more attractive for developers performing debugging, rather than for users.

Steve

---

From: Timothy Fisher <[email-masked]>
Date: Tue, 13 Jul 1999 13:43:12 -0700

Although your right that developers would benefit greatly in having an easier time
with debugging, users would also benefit.  I am certain there are times when end
users would like to view for example a certificate, but can not do so unless they
have an ASN.1/DER certificate decoder.  XML is much more readable to the average
user.

Tim

---

From: Stephen Kent <[email-masked]>
Date: Wed, 14 Jul 1999 02:19:20 -0400

Tim,

I think it is a rare user indeed who ever wants to look at a certificate.
Experience suggests that the certificate viewing feature of browsers is
rarely invoked by the average user.

Steve