[Cryptography] BitCoin bug reported

[Stephen Farrell]

Peter,

On 02/18/2014 01:56 AM, Peter Gutmann wrote:
> The downside with ASN.1, admittedly, is that it makes it easier than most
> notations to create such a mess :-(.

I do agree that ASN.1 does encourage specification writing rather
than real implementation, testing and deployment. And that is a
real downside. Turning that into a diatribe was quite amusing
around about the time I figure I cured myself of the above
affliction. But that's going on for a decade and a half ago at
least. IOW, for me, that particular joke was funny once, with
the emphasis on the past tense. Maybe others differ though.

But you ignore a bunch of boring detail, for example that the
X.500 Name data structure was intended to be part of a hugely bigger
picture (X.500) that did not work out in the real world. There
really did appear to be valid reasons to reasonable folks back
then for all the gnarliness of X.400 addresses for example, and for
including those as an option in X.500 names. Ignoring such detail
IMO risks repeating the errors, maybe in JSON or whatever is next,
and is a bad plan. I think the error of the X.500 Name is a
fairly straightforward one (but hard to recognise as you do it) of
being over general via allowing options and is constantly repeated.

To give another example, the notAfter field in X.509 was quite
reasonable for DAP authentication within an enterprise or telco
environment which was its original purpose. For the web PKI, and
even more for embedded devices, notAfter is just a total PITA, but
knowing why it was there in the first place is better than being
ignorant, which seems to be the case for some folks these days.
(I.e. it was not there to generate money for CAs.) The error of
notAfter is nothing to do with ASN.1, but is rather to do with
not getting the right balance between current and future use-cases.

Bottom line: I fear that *only* lampooning 1980's data structure
design risks repeating rather than learning from the errors made.

And it seems a bit odd to be so fixated on essentially the 1988
blue-book, from which most of the rest of the design followed.
Surely there have been some more significant errors made since?
(Snowdonia for example, to pick my own recent fav;-)

S.