Comment on RFC 2459: Validity time type

[Mats Hansson <mats.hansson@xxxxxxxxxxx>]

Dear Sirs,

I have a comment on clause 4.1.2.5: "Validity" in the RFC 2459. Most
probably, you have already had similar comments, but anyway:

Why is it not allowed to use the GeneralizedTime format for validity dates
before 2050? Why not use the next 50 years gradually allowing and
encouraging CA's and clients to switch over to a time format more suitable
for the future? The present spec. preserves the two-digit limitation and it
is not until some years before 2050 that PKI/security software will get the
real test that they are treating the four-digit representation properly.
Will we see a "close-to-2050"-bug then, all over the world, just like the
millenium-bug?

My suggestion is to allow the GeneralizedTime type now already. Or at least
start allowing it after a known date, say year 2005. So software will have a
chance to be modified. Sooner or later, we (programmers) will face the
"real" test.

Kindest regards
Mats Hansson

Mats Hansson
Intertex Data AB
Rissneleden 45
174 44 Sundbyberg
Sweden

Tel +46-8-6282828    Fax +46-8-6286414    www: http://www.intertex.se