[saag] Re: Relative OIDs are the simpler form of OID (Re : A simpler form of OID)

On Thu, Sep 18, 2025 at 03:32:37PM -0400, Phillip Hallam-Baker wrote:
> OK, so I do want to keep hold of my 'can type identifier in BASE-32'
> constraint. Because that allows an identifier to be read over a telephone.

This is a UI issue.

Elsewhere in this thread you also wrote:

> The identifier is defined as a sequence of opaque octets. Applications
> are not entitled to assume any semantics whatsoever beyond 'identifier
> sequence [x, y, z] means thing P'.

I don't see what in x.680 can keep us from having arcs below which we
can have digests and whatever other possibly non-registered things.

> So if we were going to go 'all in' on mapping everything to a Type
> identifier, I would start with an initial byte that gives us an O (113) and
> then look into some compact mapping of the OID segments to bytes.

Just use ROIDs and have a convention for that sort of thing, no?  E.g.,
if the first sub-identifier is larger than 127 then its value is to be
displayed as base32, or if it's 79 (ASCII for 'O') then the rest is a
full OID rather than relative, and if it's 85 ('U') then the rest is a
UUID, etc.  But I would argue against making this all too complicated.

> [And probably do that for UUIDs as well with an initial letter U (161)]

Ditto.

> We could probably make the resulting sequences shorter than the OID forms
> as the code points we mostly use come off a tiny number of arcs, consider
> the PKIX prefix:
> 
>       id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
>                  dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
> 
> 
> I suspect most of the OIDS we use come off either the NIST crypto arc, DOD
> Internet arc, the IANA private assignment arc or the IANA Internet arc.

Sure, we can have a way to map OIDs to base32 and back that compresses
well for small sub-identifiers.

> One side effect of this scheme is that we have an automatic means of
> converting OIDs to short ascii strings that we can then use in JOSE, XML
> digsig, etc.

That would be nice.  But nothing beats 'id-pkix' (or whatever) for
user-friendliness when you know a registry that specifies that string,
which here would be RFC 5280, but it could be IANA.

Nico
-- 

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]