Subject: Re: [pkix] useless bagage in X.509

From: Peter Gutmann <[email-masked]>
Date: Tue, 20 Nov 2012 12:27:26 +0000

Erik Andersen <[email-masked]> writes:

>It would be nice to get some examples of useless baggage in X.509.

Sure.  To see what's needed and what isn't, you just have to look at how certs
are being used on the Internet (remembering that PKIX was chartered to define
how certs were used in the Internet, although in practice it really exists to
profile them for DoD use).  So for Internet use you need:

- A public key (SEQUENCE ...)
- Owner info (or -s), consisting of a machine-readable name ("www.amazon.com",
  "[email-masked]") paired with a friendly name ("Amazon", "Erik Andersen")
  (SEQUENCE OF { UTF8String, UTF8String OPTIONAL }).
- Issuer info: A pointer to the issuing cert/CA for verification, pointers to
  other info the CA may consider useful such as a CRL location, and CA
  advertising (logo, T&C, and so on) (SEQUENCE OF { type, UTF8String }).
- An indication of the cert's usage along the lines of keyUsage (BIT STRING).
- The FOUO field for the DoD.
- A signature.

If I'm using the cert with a web server I need the server URL/FQDN (owner
info), the key, and some information to verify the cert; if I'm using the cert
for email I need the email address (owner info), usage indicator (encrypt,
sign, ...) the key, and some information to ... .  If I'm using the cert for
EAP I need... well, you get the idea.  Everything else in the cert is then
useless baggage.

Peter.

---

From: "Kemp, David P." <[email-masked]>
Date: Tue, 20 Nov 2012 14:57:12 +0000

It's interesting that you view the world as divided into "U.S. DoD" and "Internet" - I'm sure we're flattered, but there are governments and industry groups (banking, health/pharma, aerospace, education - at least on this side of the pond, ...) that have use for things like interoperable differentiated assurance (certificate policies) and worry about things like transitive trust (basic constraints) and trust itself (name constraints) that you classify as useless baggage.

There was a time when the Internet itself was useless baggage to everyone but the DoD.  But welcome aboard anyway.

Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Gutmann
Sent: Tuesday, November 20, 2012 7:27 AM
To: [email-masked]; [email-masked]
Subject: Re: [pkix] useless bagage in X.509

>It would be nice to get some examples of useless baggage in X.509.

Sure.  To see what's needed and what isn't, you just have to look at how certs are being used on the Internet (remembering that PKIX was chartered to define how certs were used in the Internet, although in practice it really exists to profile them for DoD use).  So for Internet use you need:

If I'm using the cert with a web server I need the server URL/FQDN (owner info), the key, and some information to verify the cert; if I'm using the cert for email I need the email address (owner info), usage indicator (encrypt, sign, ...) the key, and some information to ... .  If I'm using the cert for EAP I need... well, you get the idea.  Everything else in the cert is then useless baggage.

Peter.
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: "Henry B. Hotz" <[email-masked]>
Date: Tue, 20 Nov 2012 12:20:35 -0800

Until name constraints is properly implemented in a majority of implementations, it would appear to be useless baggage for a majority of PKIX users, wouldn't it?

Don't get me wrong, I'd like the capability.

> If I'm using the cert with a web server I need the server URL/FQDN (owner info), the key, and some information to verify the cert; if I'm using the cert for email I need the email address (owner in…

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]