From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Thu Jan 03 11:55:56 2008 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JATMK-0000wP-Pd for secsh-tyoxbijeg7-archive@lists.ietf.org; Thu, 03 Jan 2008 11:55:56 -0500 Received: from mail.netbsd.org ([2001:4f8:4:7:2e0:81ff:fe52:9ab6]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JATMK-0002dr-9F for secsh-tyoxbijeg7-archive@lists.ietf.org; Thu, 03 Jan 2008 11:55:56 -0500 Received: by mail.netbsd.org (Postfix, from userid 0) id C6E4B63B187; Thu, 3 Jan 2008 11:55:47 -0500 (EST) X-Original-To: ietf-ssh@NetBSD.org Delivered-To: ietf-ssh@NetBSD.org Received: from gmp-eb-mail-1.sun.com (gmp-eb-mail-1.sun.com [192.18.6.21]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client did not present a certificate) by mail.netbsd.org (Postfix) with ESMTP id 1E29363B152 for ; Thu, 3 Jan 2008 11:55:45 -0500 (EST) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m03GthLk022475 for ; Thu, 3 Jan 2008 16:55:43 GMT Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JU200L01UXS2Z00@fe-emea-09.sun.com> (original mail from Jan.Pechanec@Sun.COM) for ietf-ssh@NetBSD.org; Thu, 03 Jan 2008 16:55:43 +0000 (GMT) Received: from fossa.czech.sun.com ([129.157.71.113]) by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JU200LN9V0U1N70@fe-emea-09.sun.com> for ietf-ssh@NetBSD.org; Thu, 03 Jan 2008 16:55:43 +0000 (GMT) Date: Thu, 03 Jan 2008 17:53:32 +0100 (CET) From: Jan Pechanec Subject: Q on X.509 authentication in SSH draft X-X-Sender: jp161948@fossa.czech.sun.com To: ietf-ssh@NetBSD.org Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Sender: ietf-ssh-owner@NetBSD.org Precedence: list X-Spam-Score: -1.0 (-) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 hi, in 4.1 section of draft-ietf-secsh-x509-03.txt[1], where "x509v3-sign" format is defined, there is this sentence: >The first certificate in the list MUST be the end-entity one, and any >other certificates MUST be part of the end-entity certificate's path. depending on CA policy, not all certificates need to be accompanied with an OCSP response, but could it be assumed that OCSP response list is "sorted" according to certificates supplied? It means that one could just go through the certificate list and check the first not yet processed OCSP response for match whether it is the only SingleResponse in OCSP response or the first unprocessed SingleResponse as part of one OCSP response. I also assume that the certificate list is "sorted" but neither that is explicitly defined there and I think it should be. I don't see any problem for the party being authenticated to sent an already sorted list of OCSP responses. Well, I could live with the unsorted list, too, but the sorted list is just more efficient if we consider a long validation path. What is more important I think is that it would be nice if this is explicitly specified there. anyway, given all the options how it could be done, I'm thinking that it would be simpler to use a pair of strings for every certificate - the certificate itself and an optional OCSP response which could be an empty string. And it would be sorted for use of PKIX validation path algorithm. It wouldn't increase the length of the data much in comparison to the length of the certificates and one could easily separate them into two sorted list if needed. string "x509v3-sign" uint32 number of certificate/OCSP response pairs string DER encoded X.509v3 certificate data string optional OCSP response data string DER encoded X.509v3 certificate data string optional OCSP response data ... thanks, Jan. [1] http://www3.ietf.org/proceedings/06mar/IDs/draft-ietf-secsh-x509-03.txt -- Jan Pechanec From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Thu Jan 10 10:12:55 2008 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JCz5T-0004XB-Ow for secsh-tyoxbijeg7-archive@lists.ietf.org; Thu, 10 Jan 2008 10:12:55 -0500 Received: from mail.netbsd.org ([204.152.190.11]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JCz5S-0000Td-3G for secsh-tyoxbijeg7-archive@lists.ietf.org; Thu, 10 Jan 2008 10:12:55 -0500 Received: by mail.netbsd.org (Postfix, from userid 0) id 5E6AC63B110; Thu, 10 Jan 2008 15:12:15 +0000 (UTC) X-Original-To: ietf-ssh@NetBSD.org Delivered-To: ietf-ssh@NetBSD.org Received: from gmp-eb-mail-2.sun.com (gmp-eb-mail-2.sun.com [192.18.6.24]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client did not present a certificate) by mail.netbsd.org (Postfix) with ESMTP id 18E0463B13E for ; Thu, 10 Jan 2008 15:12:13 +0000 (UTC) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0AFC1KQ016104 for ; Thu, 10 Jan 2008 15:12:11 GMT Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JUF00K01O731P00@fe-emea-09.sun.com> (original mail from Jan.Pechanec@Sun.COM) for ietf-ssh@NetBSD.org; Thu, 10 Jan 2008 15:12:01 +0000 (GMT) Received: from fossa.czech.sun.com ([129.157.71.113]) by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JUF00JULOVP0I40@fe-emea-09.sun.com> for ietf-ssh@NetBSD.org; Thu, 10 Jan 2008 15:11:50 +0000 (GMT) Date: Thu, 10 Jan 2008 16:09:35 +0100 (CET) From: Jan Pechanec Subject: Re: Q on X.509 authentication in SSH draft In-reply-to: X-X-Sender: jp161948@fossa.czech.sun.com To: ietf-ssh@NetBSD.org Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT References: Sender: ietf-ssh-owner@NetBSD.org Precedence: list X-Spam-Score: -4.0 (----) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 On Thu, 3 Jan 2008, Jan Pechanec wrote: hi, maybe sending this while many of us were still on holiday wasn't the best idea. any thoughts on that issue please? another option would be to maintain the same number of responses to the number of certificates sent, and have them in two different lists as the current draft suggests. However, any response could be just an empty string. That would be another way to easily recognize which response is supposed to belong to which certificate, without checking certID field in the response. thanks, Jan. > > hi, in 4.1 section of draft-ietf-secsh-x509-03.txt[1], where >"x509v3-sign" format is defined, there is this sentence: > >>The first certificate in the list MUST be the end-entity one, and any >>other certificates MUST be part of the end-entity certificate's path. > > depending on CA policy, not all certificates need to be accompanied >with an OCSP response, but could it be assumed that OCSP response list is >"sorted" according to certificates supplied? It means that one could just go >through the certificate list and check the first not yet processed OCSP >response for match whether it is the only SingleResponse in OCSP response or >the first unprocessed SingleResponse as part of one OCSP response. > > I also assume that the certificate list is "sorted" but neither that >is explicitly defined there and I think it should be. > > I don't see any problem for the party being authenticated to sent an >already sorted list of OCSP responses. Well, I could live with the unsorted >list, too, but the sorted list is just more efficient if we consider a long >validation path. What is more important I think is that it would be nice if >this is explicitly specified there. > > > anyway, given all the options how it could be done, I'm thinking >that it would be simpler to use a pair of strings for every certificate - >the certificate itself and an optional OCSP response which could be an empty >string. And it would be sorted for use of PKIX validation path algorithm. It >wouldn't increase the length of the data much in comparison to the length of >the certificates and one could easily separate them into two sorted list if >needed. > > string "x509v3-sign" > uint32 number of certificate/OCSP response pairs > string DER encoded X.509v3 certificate data > string optional OCSP response data > string DER encoded X.509v3 certificate data > string optional OCSP response data > ... > > > thanks, Jan. > >[1] http://www3.ietf.org/proceedings/06mar/IDs/draft-ietf-secsh-x509-03.txt > > -- Jan Pechanec From LUCAS@YAHOO.COM Fri Jan 18 16:51:06 2008 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1JFz7C-0000E3-AX for secsh-archive@megatron.ietf.org; Fri, 18 Jan 2008 16:51:06 -0500 Received: from [201.159.6.65] (helo=smtp.cablecomrey.com.mx) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1JFz7B-0007ET-Sb for secsh-archive@megatron.ietf.org; Fri, 18 Jan 2008 16:51:06 -0500 Received: from localhost (localhost [127.0.0.1]) by smtp.cablecomrey.com.mx (Postfix) with ESMTP id 4E9701BCE47; Fri, 18 Jan 2008 12:06:14 -0600 (CST) X-Virus-Scanned: amavisd-new at cablecomrey.com.mx Received: from unknown by localhost (amavisd-new, unix socket) id fBxjhA9NakHp; Fri, 18 Jan 2008 12:06:13 -0600 (CST) Received: from webmail.cablecomrey.com.mx (localhost [127.0.0.1]) by smtp.cablecomrey.com.mx (Postfix) with ESMTP id 761711BEB0E; Fri, 18 Jan 2008 12:06:12 -0600 (CST) Received: from 80.255.59.245 (proxying for 192.168.0.15, 172.16.1.1) (SquirrelMail authenticated user pcclinic) by webmail.cablecomrey.com.mx with HTTP; Sat, 19 Jan 2008 02:06:12 +0800 (HKT) Message-ID: <42347.80.255.59.245.1200679572.squirrel@webmail.cablecomrey.com.mx> Date: Sat, 19 Jan 2008 02:06:12 +0800 (HKT) Subject: Greetings To You My Partner, From: "Mr James Lee" Reply-To: pslampaul@hotmail.com User-Agent: SquirrelMail/1.4.8 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 X-Priority: 3 (Normal) Importance: Normal To: undisclosed-recipients:; Content-Transfer-Encoding: quoted-printable X-Spam-Score: 2.0 (++) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 18/1/08 Greetings To You My Partner, I have been waiting for you before now to have contacted me for your Confirmable Bank Draft of $800.000.00 USD(Eight Hundred Thousand US DoallarS),but till this moment i have not heard from your end.I then went ahead and deposited the Draft with CXPRESS COURIER SERVICE, West Africa Region,After which i travelled out of the country for a 3 Months Course and I will not come back till Mid January. What you need to do now is to contact the CXPRESS COURIER SERVICE as soo= n as possible to ascertain when they will deliver your package to you due t= o the urgency as regards meeting the deadline of the expiring date. For your information, I have paid for the delivering Charges, Insurance premium and Clearance Certificate Fee of the Cheque(showing that the fund= s is not meant for drug traficking,nor meant to sponsor Terrorist attack in your Country) . The only money you will need to send to the CXPRESS COURIER SERVICE to deliver your Draft direct to your postal Address in your country is Two hundred USD ($200.00 USD)only,been charged you as Keeping Fee of the Courier Company so far,all the while the package has been with them.Again,don't be deceived by anybody to pay any other money except $200.00 US Dollars.I would have paid this fee, but did not agree because they don't know when you will contact them and in case of demurrage.You have to contact the CXPRESS COURIER SERVICE now for the delivery of your Draft with this information bellow: Contact Person: Mr Paul Smith Email Address:pslampaul@hotmail.com Telephone #:+(234) 08033723117. Finally, make sure that you reconfirm your Postal address(mailing address) and Direct telephone number to them again to avoid any mistake on the Delivery and ask them to give you the tracking number to enable you track your package over there and know when it will get to your address. Let me repeat again, try to contact them as soon as you receive this mail to avoid any further delay and remember to pay them their Security Keeping fee of $200US Dollars for their immediate action. You should also let me know through email as soon as you receive your Draft. Yours Faithfully, Mr James Lee _________________________________________________________________________= _________________________________-