Subject: Re: [pkix] way forward for 5280

From: Tomas Gustavsson <[email-masked]>
Date: Tue, 01 Dec 2009 11:26:14 +0100

I have tested with VisableString on Windows 7 and it does indeed seem
like windows can parse it. At least it is then possible to be rfc "may"
compliant when issuing certificates for windows machines and users :-)

Kind regards,
Tomas

Tomas Gustavsson wrote:
> 
> Not contradicting, I would say confirming. I did not test VisibleString, 
> only BMP vs UFT-8.
> This is still good news, I can now try with VisibleString. If I can dump 
> BMPString for VisibleString I would be slightly happier since we could 
> make rfc compliant certificates by default.
> 
> I'll get around to testing VisibleString.
> 
> Cheers,
> Tomas
> 
> 
> Stefan Santesson wrote:
>> I asked people at Microsoft to run a check on this and it appears after
>> quick code check that CAPI supports BMPString for encoding and 
>> VisibleString
>> and BMPString for decoding
>>
>> This is somewhat contradictory to Tomas findings.
>> But to the proposal:
>>
>>  
>>> The current document says:
>>>
>>> SHOULD UTF8
>>> MAY IA5String
>>> MUST NOT VisibleString & BMPString
>>>
>>> The proposal is:
>>>
>>> SHOULD UTF8
>>> MAY VisibleString
>>> MUST NOT IA5String or BMPString
>>>
>>>     
>>
>> If the purpose is to align with current deployment, then why not say:
>>
>> SHOULD UTF8
>> MAY VisibleString or BMPString
>> MUST NOT IA5String
>>
>>
>> /Stefan
>>
>>
>>
>> On 09-11-18 11:45 PM, "Stephen Kent" <[email-masked]> wrote:
>>
>>  
>>> At 9:21 AM +0100 11/18/09, Tomas Gustavsson wrote:
>>>    
>>>> I mean MS client software, when displaying certificates in Windows
>>>> XP for example it will only display the user notice if it is a
>>>> BMPString.
>>>> With this in mind I also assume that MS CA issues user notices with
>>>> BMPString although I haven't verified.
>>>>
>>>> Haven't tested on Vista or Win 7 though (I'm a linux fanboy :-)),
>>>> wich was the reason for the question. I can make a test of this
>>>> myself though.
>>>>
>>>> Cheers,
>>>> Tomas
>>>>       
>>> Thanks for the clarification, and the offer to run tests on Vista and 
>>> Win 7.
>>>  From what you say, it appears that the MS client and CA software were
>>> not compliant with this aspect of 5280, and would not become so under
>>> the propose changes re user notice.
>>>
>>> Steve
>>> _______________________________________________
>>> pkix mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/pkix
>>>     
>>
>>   
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 01 Dec 2009 11:37:10 +0100

Thanks Tomas,

With that confirmation, as we are trying to adapt the specification to the
reality in this aspect, I think it would be reasonable to say:

SHOULD UTF8

/Stefan

---

From: Tomas Gustavsson <[email-masked]>
Date: Tue, 01 Dec 2009 11:25:54 +0100

Kind regards,
Tomas

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 02 Dec 2009 09:51:48 +0100

That sounds reasonable to me.

Almost too pragmatic :-)

Cheers,
Tomas

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 16 Dec 2009 16:21:53 +0100

Hi,

The SCVP spec is a pretty massive piece of work, and an area worth 
looking into. Good to standardize.

I was just wondering if anyone known what the real world usage of SCVP 
is? Are there many implementations for servers and clients (I can't find 
many with google).

Kind regards,
Tomas Gustavsson
PrimeKey Solutions AB

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 16 Dec 2009 16:22:16 +0100

Hi,

Kind regards,
Tomas Gustavsson
PrimeKey Solutions AB

---

From: "Seth Hitchings" <[email-masked]>
Date: Thu, 17 Dec 2009 09:42:33 -0500

Hi Tomas,

CoreStreet has an SCVP server, Path Builder, that supports both DPD and
DPV. More information about Path Builder and client options is available
at our web site,
http://www.corestreet.com/solutions/prod_tech/pki/path_builder.html.

Seth Hitchings
Managing Architect
CoreStreet, Ltd.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tomas Gustavsson
Sent: Wednesday, December 16, 2009 10:22 AM
To: [email-masked]
Subject: [pkix] SCVP usage?

Hi,

Kind regards,
Tomas Gustavsson
PrimeKey Solutions AB

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 23 Dec 2009 17:23:15 +0100

Thanks for the answers. A merry christmas to you.

Cheers,
Tomas