Subject: [lamps] AD Review of draft-ietf-lamps-samples-05

From: Roman Danyliw <[email-masked]>
Date: Fri, 5 Nov 2021 02:40:45 +0000

Hi!

I performed an AD review of draft-ietf-lamps-samples-05.  Thanks for this helpful contribution to repeatable testing.  I have a few minor editorial comments below.  I'm advancing the document to IETF LC.  Please address them with any other LC feedback you get.

** A few editorial things:

-- Section 1.3.  Typo. s/perl/Perl/

-- Section 3.1.  Typo. s/cerificate/certificate/

-- Section 9.  In the spirit of inclusive language, please use an alternative to "blacklist"

** No issue with the content, but for awareness, in the course of validating the PKCS#12 examples in Sections 7.5 and 8.5, an unexpected issue was found in OpenSSL. To read PKCS12 files with "openssl pkcs12", you can only pass DER input, not PEM (like is provided in the draft).

==[ snip ]==
PS> openssl.exe version
OpenSSL 3.0.0 7 sep 2021 (Library: OpenSSL 3.0.0 7 sep 2021)

PS> openssl.exe pkcs12 -info -in .\lamps\section8-5.txt
CC320000:error:068000A8:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto\asn1\tasn_dec.c:1188:
CC320000:error:0688010A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:crypto\asn1\tasn_dec.c:349:Type=PKCS12
==[ snip ]==

Ben (Kaduk) graciously did a bit of troubleshooting which resulted in this issue: https://github.com/openssl/openssl/issues/16971

To parse the examples in the draft with openssl, one has to do the following:

==[ snip 2 ]==
PS> openssl.exe base64 -d -in .\lamps\section8-5-no-pem-headers.txt -out .\lamps\section8-5-decoded.txt

PS> openssl.exe' pkcs12 -info -in .\lamps\section8-5-decoded.txt
Enter Import Password:
MAC: sha1, Iteration 10240
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 5143
...
==[ snip 2 ]==

Regards,
Roman

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 08 Nov 2021 11:22:08 -0500

Thanks for this review, Roman and Ben!

> -- Section 9.  In the spirit of inclusive language, please use an alternative to "blacklist"

I've addressed these changes in git, and can produce a new draft with
these corrections whenever would be useful:

  https://gitlab.com/dkg/lamps-samples

> Ben (Kaduk) graciously did a bit of troubleshooting which resulted in this issue: https://github.com/openssl/openssl/issues/16971

Thanks for identifying this concern with OpenSSL.  I agree that the
toolkit should support -inform PEM for the pkcs12 subcommand.

        --dkg