Subject: Re: [saag] FW: New Version Notification for draft-moriarty-pkcs12v1-1-00.txt

From: Simon Josefsson <[email-masked]>
Date: Mon, 28 Jan 2013 22:22:05 +0100

Peter Gutmann <[email-masked]> writes:

> Simon Josefsson <[email-masked]> writes:
>
>>1) Publish a document that describes what is deployed out there.  This could
>>be version 1.0 of PKCS#12 with additional notes needed for interoperability
>>and completeness.
>
> That would be useful, because there are several optional bits of PKCS #12 for
> which implementations (and I'm thinking mostly of Windows here) will just
> silently break if you don't include them.  You can put in bogus/dummy values
> and things will be fine, but you do need to have something there.
>
> This document could also warn people that, for example, sixteen years after
> the publication of breakms.c, Microsoft *still* thinks that RC2/40 is an
> appropriate protection mechanism for PKCS #12 data.

This was the kind of issues I was thinking of.

>>It would be nice to expand or discuss the background of the acronym "PFX".
>
> That would probably mean recording the sordid history of the politics behind
> PFX and PKCS #12, is that something that'd fit in an RFC?

Perhaps the sordid parts could be left out.  Would it be controversial
to apply something like the following?

OLD: (section 2, Definitions and Notations)
      PFX: The top-level exchange PDU defined in this standard.

NEW:
      PFX: The top-level exchange PDU defined in this standard.  The
      acronym is sometimes expanded as Personal Information Exchange.

/Simon