Subject: Re: [saag] Status of the SCEP RFC draft

From: Peter Gutmann <[email-masked]>
Date: Tue, 9 Jan 2018 10:00:37 +0000

Jim Schaad <[email-masked]> writes:

Tying up loose ends...

>My view would be a couple of very simple examples to show major concepts in
>the document.  Base64 is better for me because I can run it through my code
>and see what happens, this also implies needing any keys used as well.  If
>you want to do a more complete set of examples (and I would encourage you),
>then a pointer to a web site someplace would be my preference.

The intent of the sample messages was more to provide a picture of "your
messages should look something like this", so a dumpasn1-formatted breakdown
of what's in there.  After watching the lengthy process with RFC 4134 I'm not
sure I want to try and sort out all the bits and pieces that would be needed
to process each message in situ.  The fact that there are nonces present would
also make it a real pain for anyone to recreate the processing, it's really
just an illustration of what the messages should look like, to help
implementers.

In terms of a pointer to a web site, that would certainly make things easier,
because the multiple layers of wrapping means I can't just include the outer
message but would have to include the inner decrypted stuff in the doc as
well.  However, I'm not sure what the view is on including links from a long-
term RFC to a potentially ephemeral external web site... is there some IETF-
blessed location to store them or link to?

Peter.

---

From: Jim Schaad <[email-masked]>
Date: Tue, 9 Jan 2018 11:27:51 -0800

I don't know that there is a solid place that is good.  Basically URL that
is not going to go away in the near future is probably just fine.  I used my
account on GitHub and created a project to hold the samples that I created
for the COSE document.  So far that has seemed to work out well as people
can contribute as well as get notifications in the event that I correct
something.

Jim

> -----Original Message-----
> From: Peter Gutmann [mailto:[email-masked]]
> Sent: Tuesday, January 9, 2018 2:01 AM
> To: Jim Schaad <[email-masked]>; 'Sean Turner' <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [saag] Status of the SCEP RFC draft
> 
> >My view would be a couple of very simple examples to show major
> >concepts in the document.  Base64 is better for me because I can run it
> >through my code and see what happens, this also implies needing any
> >keys used as well.  If you want to do a more complete set of examples
> >(and I would encourage you), then a pointer to a web site someplace would
> be my preference.
> 
> messages should look something like this", so a dumpasn1-formatted
> breakdown of what's in there.  After watching the lengthy process with RFC
> 4134 I'm not sure I want to try and sort out all the bits and pieces that
would
> be needed to process each message in situ.  The fact that there are nonces
> present would also make it a real pain for anyone to recreate the
processing,
> it's really just an illustration of what the messages should look like, to
help
> =

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 9 Jan 2018 22:39:38 +0000

Jim Schaad <[email-masked]> writes:

>I don't know that there is a solid place that is good.  Basically URL that is
>not going to go away in the near future is probably just fine. I used my
>for the COSE document.

If GitHub is fine to use, I'll go with that.  I just don't want to provide an
external link in the doc that'll require another five iterations of the text
to get right :-).

>So far that has seemed to work out well as people can contribute as well as
>get notifications in the event that I correct something.

Yeah, good point.  I'll see if I can use the JSCEP repository, which seems
like a natural fit for SCEP samples.

Peter.