RE: Straw poll for Algorithm Identifiers in Subject Public Key Info.

[Stefan Santesson <stefans@xxxxxxxxxxxxx>]

There is no single way that applications and protocol stacks may operate.

In my example, applications don't understand any public key OID. They would simply consult OID table to get a translation into something they can pass to the crypto lib. If that look-up is unsuccessful, the application will most certainly fail. But if it is successful, the application will attempt to map that key to the usage negotiated in the protocol, e.g. a TLS cipher suite. This is where I'm not at all sure that "old" applications will get it right. I have indications that they might get it wrong but I don't have any hard facts to offer yet. It worries me though to have to depend on various applications to get it right.

I would prefer to have more control in the library layer and more actively prevent applications from doing the wrong thing.


Stefan Santesson
Senior Program Manager
Windows Security, Standards


> -----Original Message-----
> From: Kemp, David P. [mailto:DPKemp@xxxxxxxxxxxxxx]
> Sent: den 16 januari 2007 15:08
> To: Stefan Santesson; ietf-pkix@xxxxxxx
> Subject: RE: Straw poll for Algorithm Identifiers in Subject Public Key
> Info.
>
> Hmmm, I'd guess that applications would fail, either gracefully
> or catastrophically, when faced with an unrecognized Subject
> Public Key Info OID.   I did miss the point that they might
> falsely accept and misuse the public key, but even after considering
> the possibility it still seems highly improbable.
>
> Dave
>
> -----Original Message-----
> From: Stefan Santesson [mailto:stefans@xxxxxxxxxxxxx]
> Sent: Tuesday, January 16, 2007 2:09 PM
> To: Kemp, David P.; ietf-pkix@xxxxxxx
> Subject: RE: Straw poll for Algorithm Identifiers in Subject Public Key
> Info.
>
> Thanks Dave,
>
> Let me clarify where I think you missed my point.
>
> I believe that it is less likely that a certificate with a critical
> extension will be falsely accepted and misused by an application. I
> believe the risk is greater that applications get it wrong and makes
> wrong use of a public key if the restriction comes as a public key OID.
>
> But this is just an educated guess.
>
> I agree that it will be hard to define complete mapping info in an
> extension. That was my point - It may make the extension overly
> complex.
>
>
> Stefan Santesson
> Senior Program Manager
> Windows Security, Standards
>
>