On 09/13/2017 09:31 AM, Michael Richardson wrote:
Robert Moskowitz <rgm@xxxxxxxxxxxxxxx> wrote:
> The devices never test out the lifetime of their certs. That is up to
Exactly...
(Do you think about the MacGyver/StarTrek/A-Team/Leverage/MissionImpossible
plot line that goes along with each engineering decision?...)
Never was into watching TV. Maybe saw half a dozen MI and maybe 4 - 5
StarTrek, so I really can't answer this... :)
> validating servers. And the iDevID is not really intended for operational
> use. Rather it is the security bootstrap for the lDevID. See the work being
> done in the ANIMA workgroup as an example of what to do with this. Michael
> Richardson, who recently joined this list is working on the related Internet
> Draft(s).
> I should test out a cert beyond 2038 on my armv7 32 bit Cubieboard. Will try
> that tomorrow....
> I HAVE made certs with this value and I am displaying their content. But that
> system is off right now. I will get one of the samples also tomorrow.
> And yes, the industry does need to think some about this...
I suspect that the value: literal value 99991231235959Z will simply come to
mean "the end of time", even after the year 10,000. It has a well known
DER encoding, and one can memcmp() it.
Perhaps we will define an OID which means "no expiry", and start including
that. I don't think the expiry date is an optional part.
Nice thought. Not really an option.
I will also have example vouchers, voucher requests and ECDSA ("prime256v1")
certs with known private keys (so you can replicate my work) for the ANIMA
BRSKI document, perhaps next week.
Do we agree on the DN and SAN content per 802.1AR? I am not entirely
confident with my reading of what I contributed to! Well at that time I
left the cert profile to others. I can send you a whole pki tree zipped
up. Do you have any 'live' specimens?
I'd rather publish Curve25519/EdDSA examples, but it's too bleeding edge for the moment.
We wait until 1.1.1 ships. But MAYBE we should be doing builds and
testing now instead of after it ships...
--
] Never tell me the odds! | ipv6 mesh networks [
Odds are it won't make a difference.
Bob
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
