Subject: [TLS] OpenPGP and TLS cert_type code point reuse

From: Sean Turner <[email-masked]>
Date: Thu, 30 Sep 2010 09:11:03 -0400

draft-mavrogiannopoulos-rfc5081bis reuses the Certificate Type value 
assigned in RFC 5081 (it's 1).  The extension defined in 
draft-mavrogiannopoulos-rfc5081bis is not backwards compatible with 
RFC 5081.  If there were many implementations, then I'd be concerned 
about reusing the value.  The authors (and I) don't think there are 
any implementations other than GnuTLS, but I'd like to know if anybody 
knows of TLS implementations that support RFC 5081.

Thanks,

spt

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 30 Sep 2010 08:18:30 -0700

At 9:11 AM -0400 9/30/10, Sean Turner wrote:
>draft-mavrogiannopoulos-rfc5081bis reuses the Certificate Type value assigned in RFC 5081 (it's 1).  The extension defined in draft-mavrogiannopoulos-rfc5081bis is not backwards compatible with RFC 5081.  If there were many implementations, then I'd be concerned about reusing the value.  The authors (and I) don't think there are any implementations other than GnuTLS, but I'd like to know if anybody knows of TLS implementations that support RFC 5081.

Given that there is a known implementation of 5081, and given that GnuTLS is reasonably well-deployed, why doesn't draft-mavrogiannopoulos-rfc5081bis simply use a new certificate type number? So far, only 2 out of >200 have been allocated, so there is no shortage.

--Paul Hoffman, Director
--VPN Consortium

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Thu, 30 Sep 2010 19:26:52 +0200

> Given that there is a known implementation of 5081, and given that GnuTLS is reasonably well-deployed, why doesn't draft-mavrogiannopoulos-rfc5081bis simply use a new certificate type number? So fa…

The problem is not strictly on the reusal of the extension but on the
reusal of the OpenPGP CertificateType, but the idea is the same. The
problem is that this reuse was made quite long ago in gnutls (when
draft-mavrogiannopoulos-rfc5081bis-01 appeared), thus having all gnutls
releases follow that approach since then.

The reason we don't change that now is that will make the draft
incompatible with gnutls openpgp support, which is supposed to describe
(this is an informational RFC and not standards track). Hence if there
are not any other implementations following RFC5081 this will have
no side effects.

regards,
Nikos

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 30 Sep 2010 10:46:07 -0700

>are not any other implementations following RFC5081 this will have

If the implementer of GnuTLS has already made the non-backwards-compatible change (yuck), *and no one else is doing the original 5081*, then reuse sounds like the better choice.

--Paul Hoffman, Director
--VPN Consortium