Subject: Summary of 9/29/04 PKINIT CMS DER vs. BER concall

From: Nicolas Williams <[email-masked]>
Date: Wed, 29 Sep 2004 13:59:37 -0500

Short version:

 - We reached tentative consensus, with some participants neither
   supporting nor objecting, and some supporting with reservations, that
   PKINIT should REQUIRE the use of DER encoding for CMS objects and
   that PKINIT should RECOMMEND the support for BER decoding of CMS
   objects.

   We now seek consensus on the mailing list.

Long version:

First, let me re-cap the issue:

 - PKINIT uses CMS

 - CMS requires the Basic Encoding Rules (BER) of ASN.1

 - Existing implementations of PKINIT implement DER-only for the CMS
   objects used by PKINIT, so their implementors would like PKINIT to
   REQUIRE DER for CMS

 - Other implementors would have PKINIT REQUIRE BER for CMS, as CMS
   does, either as a matter of principle, for reasons similar to the
   other camp's, or both.

 - The WG was deadlocked on this issue.

   A compromise was offered that would sacrifice interoperability.

   The WG then had three options.

Last week we decided that there could be no compromise that might
prevent interoperability, thus eliminating one of the three options.

But we could still not resolve the deadlock.  Instead we looked for a
mechanism by which we could resolve the deadlock: we decided to compare
the impact on each camp of adopting the other's choice.  To this end we
scheduled a new conference call and asked the relevant participants to
report on the impact on their implementations of adopting the option
they least preferred.

At today's conference call we looked at:

 - The impact on MS of either proposal, and found it to be minor.

 - The impact on Heimdal of either proposal, and found it to be minor in
   one configuration, significant in another.

 - The impact on MIT of either proposal, and found it to be small in one
   configuration, significant in another.

 - The impact on Sun of either proposal, and found it to be small.

 - The impact on two CableLabs implementors, and found it to be
   significant.

 - No implementor raised objections relating to implementation footprint
   and feasibility on embedded devices.

[Note that this is a summary, that the reports and discussion were much
more detailed than indicated above.]

Using these results the participants of today's concall reached a
tentative consensus that PKINIT should REQUIRE DER (that's
_distinguished_ encoding rules) for CMS objects.

A related, but far less contentious matter that also needed to be
resolved was whether PKINIT should RECOMMEND support for BER for CMS
objects.  On this matter we agreed that PKINIT should do so, and for a
number of reasons, including that buggy DER encoders can emit
BER-but-not-DER encodings that BER decoders can decode but DER decoders
may not, and also to allow for evolution towards requiring BER instead
of DER in some far, far off future.  Implementors that find it too
difficult to modify their decoders to support BER will probably consider
that sufficient reason not to follow this recommendation.

Nico
--