Subject: [COSE] Robert Wilton's No Objection on draft-ietf-cose-x509-07: (with COMMENT)

From: Robert Wilton via Datatracker <[email-masked]>
Date: Mon, 19 Oct 2020 12:18:30 -0700

Robert Wilton has entered the following ballot position for
draft-ietf-cose-x509-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-x509/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I would like to thank Jim Schaad for this document and all his other work at
IETF.

My only minor comment is that I was surprised by the name "x5bag", which in
computing terms I generally understand to be defined as a data structure that
is like a set but it can contain duplicate values (also known as a multiset). 
It wasn't clear to me that was the intended purpose here, but I seem to recall
that 'bag' might take a slightly different meaning in security circles?  Either
way, it might be helpful to specify both for the x5bag and x5chain whether or
not duplicate certificates are allowed to be present.

Regards,
Rob

---

From: Ivaylo Petrov <[email-masked]>
Date: Tue, 20 Oct 2020 08:28:26 +0300

Thank you Robert for your review! From this discussion [1] it appears that
indeed the intention of the usage of the term bag was not to make any
assumptions about the uniqueness of the elements. I am taking a note to
make that clear in the document regardless of the conclusion of that
discussion.

[1]: https://mailarchive.ietf.org/arch/msg/cose/VLv2E6wcGkC4YY-vFMRxnEAXrXo/

--
Best regards,
Ivaylo

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 22 Oct 2020 08:23:29 -0700

> [1]: https://mailarchive.ietf.org/arch/msg/cose/VLv2E6wcGkC4YY-vFMRxnEAXrXo/

There is also some precedent for the use of "bag" for this type of thing;
consider, e.g., https://tools.ietf.org/html/rfc7292#section-4.2.3 .

-Ben

---

From: Michael Richardson <[email-masked]>
Date: Thu, 22 Oct 2020 12:59:40 -0400

> consider, e.g., https://tools.ietf.org/html/rfc7292#section-4.2.3 .

Yes! I was trying to make allusions to some place in PKIX where bag was used.
I understand Carsten's objection that it's mathematically incorrect.
I don't care one way or another.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Thu, 22 Oct 2020 17:19:58 +0000

> -----Original Message-----
> From: Michael Richardson <[email-masked]>
> Sent: 22 October 2020 18:00
> To: Benjamin Kaduk <[email-masked]>; Ivaylo Petrov <[email-masked]>; Rob
> Wilton (rwilton) <[email-masked]>; Cose Chairs Wg <cose-
> [email-masked]>; cose <[email-masked]>; The IESG <[email-masked]>; draft-
> [email-masked]
> Subject: Re: [COSE] Robert Wilton's No Objection on draft-ietf-cose-x509-
> 07: (with COMMENT)
> 
> 

I'm fine with it being called a bag if that is the historical term in this context.  I just think that the description should be clear that it is unordered and not allowed to contain duplicates.  Of course, that is presuming that it isn't allowed duplicates ;-)

Regards,
Rob