Subject: Re: [lamps] [Anima] Content-Transfer-Encoding and HTTP 1.x in ANIMA BRSKI

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Jun 2019 21:23:29 -0400

Brian E Carpenter <[email-masked]> wrote:
    > On 18-Jun-19 05:18, Panos Kampanakis (pkampana) wrote:
    >>> So effectively, the CTE header has effectively been dropped, but the
    >>> payload is now assumed to be base64, regardless.  This suggests that
    >>> we can not use the CTE header as a signal.

    > I went and looked at RFC4648 for my own education, and then spent a few
    > minutes trying to design a Turing machine that can distinguish a binary
    > bit string from a base64 bit string. Fail. You can determine that a bit
    > string is definitely not base64 if it contains at least one character
    > outside the base64 alphabet, but not the converse. So it needs a
    > signal. Not having a signal would be wide open to malicious misuse,
    > IMHO. Indicating the length of the payload would be enough, I think.

So I conclude that we can't patch RFC7030.

We can drop the Content-Transfer-Encoding headers (and it seems that many
have done that anyway), but we are stuck with a base64 encoded payload for
the four end-points that 7030 describes.

We could create new end-points that are not base64 encoded, but that does not
seem that important.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Jun 2019 22:34:33 -0400

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Autonomic Networking Integrated Model and
> Approach WG of the IETF.

>        Title           : Bootstrapping Remote Secure Key Infrastructures (BRSKI)
>	 Filename        : draft-ietf-anima-bootstrapping-keyinfra-22.txt

> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-anima-bootstrapping-keyinfra-22

I have added a section 6:

       6.  Clarification of transfer-encoding

 	   [RFC7030] defines it's endpoints to include a "Content-Transfer-
 	   Encoding" heading, and the payloads to be [RFC4648] Base64 encoded
 	   DER.

 	   When used within BRSKI, the original RFC7030 EST endpoints remain
 	   Base64 encoded, but the new BRSKI end points which send and receive
 	   binary artifacts (specifically, ../voucherrequest) are binary.  That
 	   is, no encoding is used.

 	   In the BRSKI context, the EST "Content-Transfer-Encoding" header if
 	   present, SHOULD be ignored.  This header does not need to included.

I have not made an informative reference to ietf-lamps-rfc7030est-clarify yet.

I will stop now for awhile, to wait for consensus to catch up :-)
I think that this change needs a WG Consensus Call, and some discussion with
area director.