Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PFX: How Not to Design a Crypto Protocol/Standard (1998)

cs.auckland.ac.nz

Post reply on HN
Print view View original

11–13 of 13 posts

Re: PFX: How Not to Design a Crypto Protocol/Standard (1998)

#11

Post by jmspring »

moritonal wrote: post #6
jmspring wrote: post #2

A “standard” based off a proposal from Microsoft. Run through the RSA committee. Implemented by two relatively young engineers. One at Netscape. One at Microsoft. I was on the Netscape side of the house. I love when this article pops up. I learned a lot about ASN1and BER/DER coding in the process.

By that do you mean you were the young engineer at Netscape who helped design this? If so do you have any defence with the joy of context as why some of those decisions were made? I'd be curious at why things like "Encode these as bit strings." came about?

I was a junior engineer - it was 25+ years ago. The spec started with a proposal from Microsoft. I happen to agree with The critique.

I also recall trying to implement some of the nebulous things and it was painful. The code for encoding/deciding der/BEr was hand rolled.

Re: PFX: How Not to Design a Crypto Protocol/Standard (1998)

#12

Post by nieve »

jeroenhd wrote: post #5

> By far the most widely-used character set, and the one which is easiest to work with for most implementors, is ASCII (IA5String) or latin-1 (T61String). Coming in a rather distant second is Unicode (BMPString), which has somewhat patchy support on most systems and is often difficult to convert into anything useful. Allow only Unicode strings wherever text strings are used. This has the added advantage that no 1988-…

But then they did something bad with the Unicode just to make sure that we didn't get the full benefit of using it.
Post reply on HN