Subject: RE: ACprof: 28-bit restriction on OID components

From: "Manger, James H" <[email-masked]>
Date: Thu, 16 Mar 2000 16:15:28 +1100

>  the only operation you should do [with OIDs] is equality matching so
this argument [scanf()] doesn't justify any particular sizing 

Converting an object identifier from a BER-encoding to dotted-decimal or
value notation (or vice versa) is not quite only a "local display issue".
Most PKIX protocols use BER-encodings, but LDAP uses dotted-decimal in the
protocol (i.e. dotted-decimal is exchanged over the wire).  I would guess
that software dealing with LDAP and Certificates is likely to convert
between these two forms.

06 07 2A2482C1D1F932 <--> 1.2.36.674528434 <--> { 1 2 36 674528434 }

1st choice: support any size allowed by ASN.1, i.e. < 2^9216 bits
2nd choice: support the greater of 32 bits or the computer's largest
natively supported word size
3rd choice: support <= 32 bits
4th choice: support <= 31 bits
unacceptable: support <= 28 bits

P.S. There is no storage overhead from using a large OID component as the
only alternative is to use more than one small components.  Code size and
complexity (i.e. easy of implementation) are the issues.  Does the
simplicity of being able to use "native" 32 bit words/functions outweigh the
imposition of an arbitrary limit (~2 billion) on allowed component values?

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 16 Mar 2000 14:53:53 +0000

All,

Now that the other angels are dancing on the naming pin,
maybe we can finish this one quickly!

> unacceptable: support <= 28 bits

I go for your 4th, and would note that rfc2459 already contains
analagous things, e.g. ub-common-name is 64 etc, and that SNMP 
also has limits (to 32 bits, rfc2578) but I'd still prefer 31 
'cause of Java. I'd also be quite happy with SHOULD be <=31 and 
MUST be <=32.

(BTW: I really wonder whether we need more OIDs than there 
are atoms in the Universe or whatever. Presumably at some 
stage the only object left to identify would be another 
OID:-)

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 647 7406
61 Fitzwilliam Lane,                    fax: +353 1 647 7499
Dublin 2.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: "Charles W. Gardiner" <[email-masked]>
Date: Fri, 17 Mar 2000 09:45:11 -0500

>> 1st choice: support any size allowed by ASN.1, i.e. < 2^9216 bits

    This gets my vote.  As far as I can tell, all anyone does with these is
match them as octet strings.  (I wouldn't mind a 31- or 32-bit restriction
on each component.)

Charlie Gardiner

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 20 Mar 2000 14:05:47 +0000

> match them as octet strings.  (I wouldn't mind a 31- or 32-bit restriction

That last was choice 3 or 4, not 1. We've only been discussing the size
of the components, not the overall size.

Stephen.