Subject: Re: I-D ACTION:draft-ietf-pkix-logotypes-01.txt

From: "Tom Gindin" <[email-masked]>
Date: Mon, 8 Apr 2002 10:35:41 -0400

The following is just a personal opinion, but one based on fairly
well-understood trends.  I don't think that in-line logotypes are CURRENTLY
worth the space that they'd take up on a smart card, but I would guess that
they will be in two more smart-card generations and perhaps only one.
Given the amount of time between standard proposal and deployment, it's not
premature to standardize it.
      However, I also have a question about the current data structure.
First, why is the URI optional (assuming that the only binary value is the
digest, as at present)?  Second, why would we not permit in-line logotypes
(in which case the URI is suppressed)?  This would require some edits to
LogotypeData, but nothing very difficult.  One possibility would be:
      LogotypeData ::= SEQUENCE {
          typeOfLogotype       TypeOfLogotype,
          hashAlgorithm        AlgorithmIdentifier,   -- might be OPTIONAL,
it's not meaningful for GIF's
          CHOICE  {
            logotypeDataHash     OCTET STRING,
      gif   [0]         IMPLICIT OCTET STRING
      },
          logotypeDataUri      IA5String OPTIONAL }

      Another would be:
      LogotypeData ::= SEQUENCE {
          typeOfLogotype       TypeOfLogotype,
          CHOICE  {
            logotypeReference VerifiedReference,
      gif               OCTET STRING
      }
          }
      VerifiedReference ::= SEQUENCE {
            hashAlgorithm     AlgorithmIdentifier,
            dataHash    OCTET STRING,
            CHOICE      {
                  uri          IA5String,
                  intlUri           UTF8String  }
      }

      IMO VerifiedReference is a generally useful type, so its names do not
contain reference to logotypes.  My understanding of COMPONENTS OF, which
may be faulty, is that defining LogotypeData using COMPONENTS OF
VerifiedReference as an element of a CHOICE would not produce a useful
result because each of the elements of VerifiedReference would show up in
the CHOICE rather than merely hashAlgorithm going into the CHOICE with the
other fields added to LogotypeData's SEQUENCE.

            Tom Gindin

---

From: "Housley, Russ" <[email-masked]>
Date: Mon, 08 Apr 2002 13:17:11 -0400

>premature to standardize it.

I tend to agree with your assessment of storage on smart cards.  Today, all 
of the certificates stored on one smart card are likely to be associated 
with one community.  Therefore, a logo will like appear on the smart card 
itself.

Of course, there are other places that certificates and private keys are 
stored....

>other fields added to LogotypeData's SEQUENCE.

We are in the final steps of an updated I-D.  It addresses some of these 
issues, but not all.

Is there a reference for UTF8String URI?

Russ