Subject: Re: DER in ac509prof-03

From: [email-masked] (Peter Gutmann)
Date: Thu, 11 May 2000 05:23:41 (NZST)

Paul Koning <[email-masked]> writes:

>Also, while old RFCs are still available, 12 year old ITU specs may only 
>exist in antique shops by now.   

It's the same for ASN.1 books, Prof.Larmouth's book is for current versions of
ASN.1 rather than the obsolete versions referenced in RFC's, so it would 
probably do more to confuse than help.  The only reference for the obsolete
variant of ASN.1 is Douglas Steedmans "Tutorial and Reference", which is 
useful for that version but doesn't apply to any current version.  This book
has been out of print for years, so you'd actually have to go to antique
shops (well, used book stores) to find it.

>Clearly, it is not acceptable to have an RFC that points to an outside 
>standard unless that outside standard is available.

It could be argued that the ASN.1 specs, being ISO standards, aren't usefully 
"available" no matter whether it's an obsolete or current version which is 
being referenced :-).

Peter.

---

From: "Rich Ankney" <[email-masked]>
Date: Wed, 10 May 2000 15:48:56 -0400

Simple; just update everything to ASN.1:1997 :-)

-----Original Message-----
From: Paul Koning <[email-masked]>
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Wednesday, May 10, 2000 3:01 PM
Subject: Re: DER in ac509prof-03

>>>>>> "Rich" == Rich Ankney <[email-masked]> writes:
>
> Rich> I heard from a generally reliable source that ITU-T is going to
> Rich> cave in and distribute the ASN.1 specs (X.680 and X.690) for
> Rich> free via their website. 
>
>That would be cool.  But what about X.208-1988?  Given the discussion
>we just had, if *that* one isn't available (free or for money) we have
>a real problem.
>
>  paul

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 11 May 2000 08:13:07 (NZST)

"Phillip H. Griffin" <[email-masked]> writes:

>>It's the same for ASN.1 books, Prof.Larmouth's book is for current versions 
>>of ASN.1 rather than the obsolete versions referenced in RFC's, so it would
>>probably do more to confuse than help.
>
>Larmouth's books certainly covers the current standards, but it is far from 
>being irrelevant to understanding any version of the ASN.1 standards. The 
>book covers such topics from antiquity as ANY DEFINED BY, ANY, and MACRO. All
>of the ASN.1 types covered in the earlier Steedman book are also covered, as 
>well as new types such as UTF8String and RELATIVE-OID that are not specified
>in X.208/209.

What I was concerned with is that since it covers features not present in the
1988 version, anyone using it as a reference could end up using features which
aren't in the older version (it's a bit like using an ANSI C manual to write
K&R code, it's backwards-compatible but you wouldn't want to rely on it as a 
reference for K&R programming).  Unless Larmouth's book is very explicit over 
which features can't be used in the 1988 version, people using it could end up 
accidentally using post-1988 ASN.1 features.

Peter.

---

From: [email-masked]
Date: Thu, 11 May 2000 11:01:58 -0400

I do, actually, have a constructive suggestion here along with the
various standards discussions below.  Why don't we have a 1993 module which
imports from the 1988 module, not duplicating all of the syntax
definitions, and some comments in the 1988 module about which statements
need to be commented out and replaced by imports for conformance to 1997
syntax?  There are not many of these in 2459, anyway - AlgorithmIdentifier,
AttributeTypeAndValue, PolicyQualifierInfo, OtherName and
ExtensionAttribute.
     If the reason for dumping the 1993 module was the workload of doing
simultaneous updates to two modules and ensuring that they matched, this
would reduce that substantially.

          Tom Gindin

"Phillip H. Griffin" <[email-masked]> on 05/10/2000 09:11:30 PM

Please respond to [email-masked]

To:   pkix list <[email-masked]>
cc:
Subject:  Re: DER in ac509prof-03

Tom,

Comments below.

[email-masked] wrote:
>
>      In practice, what we mean by "1988 syntax", as far as I can tell, is
> pretty much the following:
>
> 1 -  Avoiding the following three types first defined in post-1988
> versions: Instance-of, Embedded-pdv, and Unrestricted character string,
and
> adding explicit definitions for the Unicode string types which are copied
> from X.680.
> 2 -  Continuing to use "ANY DEFINED BY", as defined in X.208 section 27
and
> X.680 appendix H.3, rather than using constructs with similar meaning
first
> defined in 1993-4, such as information object classes and their fields.
> 3 -  Avoiding the use of either macros (legal in 1988) or information
> object classes (legal after 1993-4).
>
>      The only part of this which seems even questionable is point 2, but
> X.680 still contains support for ANY DEFINED BY, although it is
deprecated.
> I was not at Adelaide, which partly accounts for my suggestion of 1993
> support in AC509Prof.

No version of X.680 contains support for ANY DEFINED BY.
In the 1994 version, ANY DEFINED BY was discussed as
deprecated notation in an *informative* annex, and was
not part of any *normative* text in that standard.

[Tom Gindin] A definition of the feature appears in that version of the
standard, although explicitly deprecated.  It is a rather academic question
whether that document "contains support" for the feature.  My point was
that no reference to X.208/X.209 is strictly necessary, although we
apparently can't go beyond X.680:1994 without replacing the ANY DEFINED BY
occurrences with information object classes.

During the last revision of X.680, both of the normative
sections describing ANY DEFINED BY and the MACRO notation
were removed, and the section you refer to no longer exists
in the most recent publication of the standard, ITU-T Rec.
X.680:1997 | ISO/IEC 8824-1 (1998).

[Tom Gindin] I don't have the 1997-8 versions, and I doubt that I am the
only one who doesn't.  What positive changes other than the definition of
new string types were made to X.680 and X.681 (as opposed to X.690) between
1993-4 and 1997-8?  The removal of ANY DEFINED BY does not qualify as a
positive change, and it makes it impossible to produce definitions which
compile both in 1988-90 and 1997-8 formats.

>      I don't think that the bits on the line change for BER between
> X.209(1988) and X.690(1994) if the ASN.1 is legal 1988 syntax.  Does
> anybody know of changes specific to DER?
>

You are correct that the bits on the line did not change
for BER between the X.209:1988 and X.680:1997 publications.
However, the same can not be said for X.509:1987 DER. The
set of restrictions defined at that time were only intended
for use in the Directory specification at that time, long
before version 3 certificates.

It wasn't until the added complexity of X.509v3 extensions
came about that these 1987 rules became insufficient. They
were probably designed only to be correct at that time for
limited use within the Directory ASN.1. They were not
designed to cover all possible uses of ASN.1.

[Tom Gindin] Looking at your other posting, you cite several types whose
DER encodings were changed.  Obviously, the PKIX and X.509 communities care
about the DER encodings of BIT STRING's, UTCTime's, and GeneralizedTime's.
To the best of my knowledge, there are no occurrences of either REAL or
GeneralString in any relevant standard - I checked X.520 (1993), X.509v4
current draft, PKCS#9 current draft, the new-part1, ac509prof, and 2510bis
drafts, and RFC's 1274, 2459, 2510, 2511, 2587, and 2797.

(snip)