RE: Coding Of Public Signature Algorithm Identifier

If we used the OIDs, they would appear as the 9-octet or 11-octet hex-string
constants I identified yesterday.  This does seem like bloat, but there
would be no need for an ASN.1 parser to handle them.

So far I've had Mikael's note and a private one from Daniel Senie in favour
of a separate IANA registry.  Marcus, how do we proceed?

> -----Original Message-----
> From: Mikael Olsson [mailto:[email protected]] 
> Sent: Monday, January 13, 2003 5:13 PM
> To: Taylor, Tom-PT [CAR:5N00:EXCH]
> Cc: [email protected]
> Subject: Re: Coding Of Public Signature Algorithm Identifier
> 
> 
> 
> Tom, all,
> 
> The views of a programmer that dislikes bloat...
> 
> Tom-PT Taylor wrote:
> > 
> > 1) use the OIDs.  In that case, how do I specify the 
> encoding in our 
> > record: use only the value portion of the OID as encoded in 
> ASN.1, or 
> > use the entire ASN.1 object?
> 
> If you decide to go this route, I beg you: do NOT use ASN.1 
> encoding. It's an open invitation to disaster.
> 
> Reference:
> - "ASN.1 parsing errors exist in implementations of SSL, TLS, S/MIME, 
>    PKCS#7 routines"
>   http://www.kb.cert.org/vuls/id/748355
> - "CA-2002-03: Multiple Vulnerabilities in Many 
> Implementations of the 
>    Simple Network Management Protocol (SNMP)"
>   http://www.cert.org/advisories/CA-2002-03.html
> 
> > 3) establish our own list of signature algorithm 
> identifiers, covering 
> > the same ground as the RFC 3279 OIDs.
> 
> 
> My personal opinion would be to establish a separate 
> registry. A _small_ one. How does two entries sound? For example:
> - 1024-bit RSA encrypted SHA-1 digest
> - 2048-bit RSA encrypted SHA-1 digest
> 
> Seriously, the X.509 and IPsec registries cover far more 
> ground than is needed for a protocol as "small" as itrace, in 
> my opinion.
> 
> 
> -- 
> Mikael Olsson, Clavister AB
> Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
> Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
> Fax: +46 (0)660 122 50       WWW: http://www.clavister.com
>