Subject: RE: The BER vs DER proposal

From: "Eric Rosenfeld" <[email-masked]>
Date: Thu, 28 Oct 2004 16:07:07 -0600

Jeff,

I appreciate the effort you have put into developing some text for
resolving this issue. I do apologize for the delay in responding. I have
been extremely busy over the past week.

While, I am not pleased with the outcome of this issue (for obvious
reasons), your proposal does seem to be the next best solution given the
views expressed by a large part of the working group. So, I reluctantly
agree with the text.

Thanks,
Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]] 
Sent: Thursday, October 21, 2004 3:20 PM
To: [email-masked]
Subject: Re: The BER vs DER proposal

I was hoping to get feedback from Eric before I posted this response
but for whatever reason I have not received any.  The following is
formal proposed text which follows the direction set by Eric and
Larry.  I believe that this text will meet with agreement of most
parties on this list.  If the Packet Cable representative concur
I think that we will have our rough consensus.

Replace in section 3.1.2:

"All structures MUST be encoded using Distinguished Encoding Rules
(DER).".

with

"All data structures defined in this document MUST be encoded using
Distinguished Encoding Rules (DER).  All imported data structures must
be encoded according to the rules specified in Kerberos [1] and CMS [2]
as appropriate.

"Interoperability note:  Some implementations may not be able to
decode CMS objects encoded with BER but not DER, specifically they may
not be able to decode indefinite length encodings.  To maximize
interoperability implementers SHOULD encode CMS objects used in PKINIT
using DER."

Jeffrey Altman

Liqiang(Larry) Zhu wrote:

> Eric and I finally came to an agreement. Hopefully this proposal will
> get into the next version
>
========================================================================
> ===============
> 
> Summary of the proposal
> ----------------------
> We shall leave the encoding of CMS objects to the CMS spec, but we
> should also add a section on interoperability that recommends DER.
> 
> 
> 
> Specific text (this can be in a separate section, just need to make it
> easy to spot)
>
------------------------------------------------------------------------
> ------------
>    Interoperability note on the encoding of CMS objects: 
> 
> 
>   Many early and current implementations can only decode DER encoded 
>   CMS objects.  Tags encoded with indefinite length can be quite 
>   difficult to decode correctly.  Furthermore, even RFC 3369 fell 
>   short of demanding its decoders being able to decode all valid BER 
>   encoded objects.  To maximize interoperability and security, it is 
>   strongly recommended that implementers of this specification should 
>   encode all CMS objects in DER or select only those off-the-shelf CMS

>   libraries that can guarantee the encoding is DER.
> 
> =========================================================
> 
> Would this working group accept this proposal and move on.
> 
> -- Larry
>