Subject: RE: CONSENSUS CALL - BER vs DER

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Thu, 7 Oct 2004 17:54:54 -0700

I support this approach.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Jeffrey
Hutzelman
Sent: Thursday, October 07, 2004 2:46 PM
To: IETF Kerberos Working Group
Subject: CONSENSUS CALL - BER vs DER

On Wednesday, September 29, 2004 13:59:37 -0500 Nicolas Williams 
<[email-masked]> wrote:

> Short version:
>
>  - We reached tentative consensus, with some participants neither
>    supporting nor objecting, and some supporting with reservations, that
>    PKINIT should REQUIRE the use of DER encoding for CMS objects and
>    that PKINIT should RECOMMEND the support for BER decoding of CMS
>    objects.
>
>    We now seek consensus on the mailing list.

I would like to be able to make a determination on Monday as to whether we 
have concensus in the working group to go ahead with the results arrived at 
during the conference calls.  To do that, I need to hear from the 
membership of the working group, as soon as possible.

If you support this approach, say so.
If you don't care for this approach but will live with it, say so.
If you object to this approach, say so.

I don't want to hear more rehashing of the same arguments we've been having 
for months.  However, if, after reading Nico's summaries of both calls, you 
have an issue that you believe was not considered, say so.

Ultimately, this is a case where we have two more or less equally valid 
choices, and to make progress we must pick one.  We can keep arguing 
forever, but that will not change these facts -- it will only delay PKINIT.

-- Jeff

---

From: "Eric Rosenfeld" <[email-masked]>
Date: Fri, 8 Oct 2004 09:07:49 -0600

I support the proposal.

-Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Thursday, October 07, 2004 3:46 PM
To: IETF Kerberos Working Group
Subject: CONSENSUS CALL - BER vs DER

>    We now seek consensus on the mailing list.

I would like to be able to make a determination on Monday as to whether
we 
have concensus in the working group to go ahead with the results arrived
at 
during the conference calls.  To do that, I need to hear from the 
membership of the working group, as soon as possible.

I don't want to hear more rehashing of the same arguments we've been
having 
for months.  However, if, after reading Nico's summaries of both calls,
you 
have an issue that you believe was not considered, say so.

Ultimately, this is a case where we have two more or less equally valid 
choices, and to make progress we must pick one.  We can keep arguing 
forever, but that will not change these facts -- it will only delay
PKINIT.

-- Jeff

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 10 Oct 2004 15:36:58 -0700

I support this approach.

-- Larry

P.S. Jeff it may help if you list the participants of the conf calls.
Folks in the conf call reached rough consensus supporting it and but
some of them may not have replied to this thread. Although some of which
may have already changed their positions by now.

-----Original Message-----
[mailto:[email-masked]] On Behalf Of Jeffrey

I would like to be able to make a determination on Monday as to whether
we have concensus in the working group to go ahead with the results
arrived at during the conference calls.  To do that, I need to hear from
the membership of the working group, as soon as possible.

I don't want to hear more rehashing of the same arguments we've been
having for months.  However, if, after reading Nico's summaries of both
calls, you have an issue that you believe was not considered, say so.

-- Jeff

---

From: "Labh, Nirmal" <[email-masked]>
Date: Mon, 11 Oct 2004 00:27:53 -0400

Will live with it.

---
Nirmal
---

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Liqiang(Larry)
Zhu
Sent: Sunday, October 10, 2004 6:37 PM
To: Jeffrey Hutzelman; IETF Kerberos Working Group
Subject: RE: CONSENSUS CALL - BER vs DER

 I support this approach.

-- Larry

P.S. Jeff it may help if you list the participants of the conf calls. Folks
in the conf call reached rough consensus supporting it and but some of them
may not have replied to this thread. Although some of which may have already
changed their positions by now.

-----Original Message-----

I would like to be able to make a determination on Monday as to whether we
have concensus in the working group to go ahead with the results arrived at
during the conference calls.  To do that, I need to hear from the membership
of the working group, as soon as possible.

If you support this approach, say so.
If you don't care for this approach but will live with it, say so. If you
object to this approach, say so.

-- Jeff

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 12 Oct 2004 02:56:25 -0700

Love wrote:
> If the text was written as an interrop requirement I would be fine
with it, its the MUST that I don't like.

Great. I do not think anybody who is sane would like to use generic BER
encoded CMS objects in security protocols, especially with the infamous
indefinite length encoding. But the BER requirement is already in the
CMS standard and we have to live with it.

And what we do here is that we are trying to get over a deadlock when
PKINIT is so close to be done.  Please let's not argue about whether it
is technically better if we have full compliance, in reality I do not
care and Eric does not care. 

Let's not forget in IETF our success is judged by the number of
interoperable implementations.

Eric, would you be happy if we add a section that states for interop
purposes CMS objects used in PKINIT SHOULD be encoded in DER, the
receiver MAY reject non-DER encoded objects. This way we can warm
implementers to have discretion in choosing off-the-shelf CMS libraries.
This is short of a MUST on DER, but if this is the best we can do, can
you move on?

Jeff as we too have a large installation base, we understand very well
how expensive and painful it is to change something that is already
deployed.  You listed two choices, but I suspect there could be a third
one where we can leave sufficient rooms for PacketCable.

Larry
-----Original Message-----
From: Love [mailto:[email-masked]] 
Sent: Monday, October 11, 2004 11:18 PM
To: Liqiang(Larry) Zhu
Cc: IETF Kerberos Working Group
Subject: Re: CONSENSUS CALL - BER vs DER

"Liqiang(Larry) Zhu" <[email-masked]> writes:

> Folks here seemed to be willing to alienate earlier adaptors of PKINIT

> too easily.
>
> I would give more consideration to existing deployed code bases than 
> new implementations.
>  
> Apple for example strikes me as having more resources than most of 
> PacketCable vendors I know of.  If Microsoft can live with the 
> additional DER-encoding constrain, it should not be too hard for folks

> from Apple.
>
> I have more sympathy for Heimdal however, but I suspect Love would 
> eventually find a way around.

Heimdal wont have no problem with MUST DER, given that Heimdal have a
CMS lib that today generates DER. But I regardless of this, I think that
its wrong to add restrictions to CMS.

If the text was written as an interrop requirement I would be fine with
it, its the MUST that I don't like.

Love