pem-dev
[Top] [All Lists]

Re: X.509 v3 support

1995-01-13 15:16:00
I think it would be a good idea to have the IETF (or some organization
speaking for the IETF process, perhaps ISOC) registered as an "ISO-identified
organization" (i.e. under the OID 1.3) which would make it easier for any RFC
or internet standard to specify own OIDs in a globally collision-free way if
they need it. 

I certainly agree. I was under the impression that the Internet Society was
already so registered, but I guess not. Maybe it has a DOD OID, reflecting its
ARPAnet routes? but an ISO-identified organization OID would be better. They
could also register under ANSI, but since the Internet Society claims to be an
international orgnaization, registering under ISO would be more politically
correct.

The 1422-defined RevocationList is a good example where you have a lack of 
specification when you use PEM in conjunction with an X.500 Directory. To get 
registered as an ISO-identified organization is an easy process at no cost,
and other organizations like OIW or EWOS did it as well.

Somebody correct me if I am wrong, but I thought that the use of OIDs and
organizationally qualified attributes registered under the global name
registration tree, e.g., under the  joint-iso-ccitt arc (2, was independent of
and subsumes X.500. I can't cite the relevant standard, but I thought it was
either in the X.200 or X.600 series, neither of which I am very familiar with.

BTW, this could be a possibility to get rid of the RSADSI-defined OIDs
1.2.840.113549.x.y.z (from RFC 1423 and PKCS) which can be a pain on platforms
with 16-bit integers (for instance, when using the ISODE pepsy-compiler for
ASN.1 encoding/decoding on a MS-DOS platform).

Gee, if you had a Pentium I might have been more sympathetic. but I'm almost
sure that my MS-DOS machine can count beyond 64K. I understand that some
packages even implement multiple-bit arithmetic, say up to 1028 bits, nicht
wahr? :-) Maybe they ought to fix the compiler! 

But I don't disagree with the suggestion once an algorithm is standardized
within the IETF, assuming there are no proprietary considerations. It ought to
be part of the later stages of standards processing, but like Amanda I don't
understand all of the steps involved in progressing a document along the
standards trail (or is it trial? :-).


Bob
--------------------------------
Robert R. Jueneman
GTE Laboratories
40 Sylvan Road
Waltham, MA 02254
FAX: 1-617-466-2603 
Voice: 1-617-466-2820


<Prev in Thread] Current Thread [Next in Thread>