Subject: Re: comments on draft-ietf-krb-wg-kerberos-clarifications-02.txt

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 07:42:52 -0800

On Sat, Nov 30, 2002 at 01:28:37AM -0500, Marcus Watts wrote:
> Sam Hartman wrote:
> ...
> > > I completely agree this is the goal of the standardization effort.  I
> > > believe that the clearest way we can describe ASN.1 is to refer to the
> > > ISO specification.  If we attempt to clarify it ourselves we are
> > > likely to create ambiguities by accidentally disagreeing with the real
> > > spec or by having different emphasis or simply by being too brief.
> ...
> 
> I had always thought ISO specifications were expensive and
> hard to get.  It's with some amazement I can say that I found a copy
> referenced from:
> 	http://asn1.elibel.tm.fr/en/standards/
> pointing to this:
> 	http://www.itu.int/ITU-T/studygroups/com17/languages/x680-x693_0702.pdf
> I don't know if this is a permament thing, or a temporary aberation.

It's permanent and those standards have been distributed freely online
for some time now.

Note that you can find other ITU-T documents there and that the ASN.1
docs are split up into various sub-documents:

http://www.itu.int/ITU-T/studygroups/com17/languages/

 - X.680 describes ASN.1 as it was, mostly, until 1990 (sans macros and
   sans ANY and ANY DEFINED BY, neither of which is used in Kerberos V)

 - X.681, X.682 and X.683 describe the ASN.1 Information Object system
   (and associated syntax and concepts), which is also NOT used in
   Kerberos V

 - X.690 describes BER, DER and CER (Kerberos V uses DER)

 - X.691, X.692 and X.693 describe PER, ECN and XER, respectively

x680-x693_0702.pdf is a single document containing all of the above.

> I also don't know how prone to confusion this document is - I've seen
> other standards that were not sufficiently clear to permit unambiguous
> interoperable implementations to co-exist.  For what it's worth, the
> URL above points to an *newly updated* ASN.1 standard, although the
> changes seem to be mainly the descriptive grammar not the wire
> protocol.

ASN.1 has evolved plenty over the years.  But the only changes in the
base standard that Kerberos V uses that are relevant to Kerberos are the
introduction of new string types, specifically UTF8String (in 1998,
IIRC).  Granted I'm relying on what the various ASN.1 books say about
this here, mostly because there's no freely available copies of earlier,
now withdrawn ASN.1 standards to compare the current ones with.

> 				-Marcus Watts
> 				UM ITCS Umich Systems Group

Cheers,

Nico
--