TRC description: mandate normalization, introduce language tag and localizedDescriptions by nicorusti · Pull Request #137 · scionassociation/scion-cppki_I-D

nicorusti · 2026-04-30T10:02:46Z

Resolves #136

Diff with main

Slack discussion

TODO:

Ensure latest trc.asn1 is copy pasted to appendix before merging

…ge tags (RFC5646)

oncilla

Nit: i would change the field names slightly

Co-authored-by: Dominik Roos <domi.roos@gmail.com>

nicorusti · 2026-05-15T13:43:34Z

Hi @oncilla, I incorporated your suggestions in the PR. Good to hear that you like the overall approach, and thanks for posting your comments.. I also sometimes forget to click publish…

Did you already check that the existing TRCs are compatible with this ASN.1 module?

With the updated ASN.1 module here, I can successfully decode various TRCs in ASN.1 studio:

In general looks good to me, but I need to double check how existing code will behave if a TRC with these new fields is encountered.
How long does it take?
I would merge the PR if we don’t expect other changes, but leave Issue #136 open until you can get this tested. If it helps, I dropped a TRC with the extended description. it would be good to check how this affects signing of the TRC. This way you can take your time. We anyways have at least a few weeks before the draft goes to publication, since Eliot will also do a final review on his side.

If you feel this change needs more community input, I can post it on scionproto, but I’m not sure there are more people understanding PKI as deep as you.

oncilla · 2026-05-18T11:17:23Z

Hi @oncilla, I incorporated your suggestions in the PR. Good to hear that you like the overall approach, and thanks for posting your comments.. I also sometimes forget to click publish…

Did you already check that the existing TRCs are compatible with this ASN.1 module?

With the updated ASN.1 module here, I can successfully decode various TRCs in ASN.1 studio:

Cool. Thanks for checking!

In general looks good to me, but I need to double check how existing code will behave if a TRC with these new fields is encountered. How long does it take? I would merge the PR if we don’t expect other changes, but leave Issue #136 open until you can get this tested. If it helps, I dropped a TRC with the extended description. it would be good to check how this affects signing of the TRC. This way you can take your time. We anyways have at least a few weeks before the draft goes to publication, since Eliot will also do a final review on his side.

I created a draft PR with what I did to check: scionproto/scion#4927
As far as I can tell, the change is forward and backward compatible. So all good from my side!

If you feel this change needs more community input, I can post it on scionproto, but I’m not sure there are more people understanding PKI as deep as you.

It's probably good form to announce this in the community. I don't think there is going to be much input though.

tzaeschke · 2026-05-22T08:36:37Z

+    authoritativeASes     SEQUENCE OF ASN,
+    description           UTF8String (SIZE (1..8192)) OPTIONAL,
+    certificates          SEQUENCE SIZE (1..4095) OF Certificate,
+    	localizedDescriptions [0] SEQUENCE SIZE (1..MAX) OF LocalizedText OPTIONAL,


Instead of MAX, I suggest using a very low number here, e.g. 5.

I also wonder, do we really need 8KB?
How about limiting it to 256 bytes?
Same for the localizations. Also, localizations don't need to have the same length as the main description...?

The problem is really that this can be exploited to create really large TRC that could even be used as an attack (as discussed in the meeting yesterday).

The size concern also goes for other fields, do we really need 2000 votes or 4000 certificates?

Is TRC size a real threat vector? If yes, is it prevented with hard limits in the spec?

I mean, if you see a 1 GB certificate/TRC, you maybe don't want to open it anyways and I think implementations may have some limits internally. Is it the case?

We have to review many field limits, I suggest that we merge this PR, which is about language tags, and then review field sizes in #153

tzaeschke · 2026-05-22T08:45:07Z


+LocalizedText ::= SEQUENCE {
+    language        PrintableString,
+    content         UTF8String (SIZE (0..8192))


Suggested change

content UTF8String (SIZE (0..8192))

content UTF8String (SIZE (1..256))

See discussion below on description field: We should probably avoid bloated TRC.

The current SSHN TRC does not fit (even tough it uses multiple languages without tags).
#127 (comment)

With @oncilla we discussed here that 4096 or 8192 is an acceptable size.. I would not make it smaller than 4096 (or bare minimum 1024)

We have to review many field limits, I suggest that we merge this one and then just review field sizes in #153

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

nicorusti · 2026-05-22T13:30:08Z

It's probably good form to announce this in the community. I don't think there is going to be much input though.

FOr the record, this was discussed at TC #10 on 21.05.2026 with no objections. It was also announced on Slack and it will be brought to the OS contributor call next week.

tzaeschke

I approve, but I think we need to discuss the "NOT empty" further, I think it doesn't express what it is supposed to express (see my comment below)....

nicorusti · 2026-05-22T16:10:18Z

For the record, enclosed the html diff corresponding to this PR
Diff_ draft-dekater-scion-pki.txt - draft-dekater-scion-pki.txt.html

nicorusti added 2 commits April 30, 2026 12:01

TRC description: mandate normalization (RFC5198) and recommend langua…

8649378

…ge tags (RFC5646)

should for normalization

8e1b5fa

nicorusti marked this pull request as ready for review April 30, 2026 14:08

update acknowledgements

3f857b7

oncilla reviewed May 11, 2026

View reviewed changes

Comment thread draft-dekater-scion-pki.md Outdated

Update draft-dekater-scion-pki.md

476ee10

nicorusti mentioned this pull request May 12, 2026

Language tags in TRC description (RFC 5198) and UTF-8 normalization #136

Closed

reference to BCP47

3909766

nicorusti commented May 12, 2026

View reviewed changes

Comment thread draft-dekater-scion-pki.md Outdated

nicorusti requested a review from oncilla May 12, 2026 13:23

Merge remote-tracking branch 'origin/main' into description_encoding

ce8c8cb

oncilla reviewed May 12, 2026

View reviewed changes

Comment thread draft-dekater-scion-pki.md Outdated

Comment thread draft-dekater-scion-pki.md Outdated

introduce a and a field

2014e7c

nicorusti requested a review from oncilla May 12, 2026 17:40

indent

fcb6bc7

nicorusti mentioned this pull request May 15, 2026

Review Til Chpt 3 #144

Closed

oncilla reviewed May 15, 2026

View reviewed changes

Comment thread asn1/trc.asn1 Outdated

Comment thread asn1/trc.asn1 Outdated

nicorusti and others added 4 commits May 15, 2026 15:15

Update asn1/trc.asn1

77ea507

Co-authored-by: Dominik Roos <domi.roos@gmail.com>

Update asn1/trc.asn1

d60c4ed

Co-authored-by: Dominik Roos <domi.roos@gmail.com>

update variable names and align module in draft

2c809ba

update draft

46e6b9f

nicorusti changed the title ~~TRC description: mandate normalization and recommend tags~~ TRC description: mandate normalization, introduce language tag and localizedDescriptions May 15, 2026

tzaeschke reviewed May 22, 2026

View reviewed changes

nicorusti and others added 5 commits May 22, 2026 12:36

Merge remote-tracking branch 'origin/main' into description_encoding

25bd9fd

Update draft-dekater-scion-pki.md

daf57c2

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

Update asn1/trc.asn1

c8af621

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

Update draft-dekater-scion-pki.md

c297380

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

Update asn1/trc.asn1

b74edd9

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

nicorusti and others added 3 commits May 22, 2026 14:19

indent

44f10dc

Update draft-dekater-scion-pki.md

d4ded14

Co-authored-by: Tilmann <tilmann_dev@gmx.de>

language tag wording

4621ae0

nicorusti added 2 commits May 22, 2026 15:33

align appendix to ASN.1 file

6689cc8

changelog

c5a0e92

nicorusti requested a review from tzaeschke May 22, 2026 13:50

tzaeschke approved these changes May 22, 2026

View reviewed changes

Comment thread draft-dekater-scion-pki.md Outdated

tzaeschke approved these changes May 22, 2026

View reviewed changes

Update draft-dekater-scion-pki.md

ca9982d

nicorusti merged commit 2879f98 into main May 22, 2026
2 checks passed

nicorusti deleted the description_encoding branch May 27, 2026 08:09

	content UTF8String (SIZE (0..8192))
	content UTF8String (SIZE (1..256))

Conversation

nicorusti commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

oncilla left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nicorusti commented May 15, 2026

Uh oh!

oncilla commented May 18, 2026

Uh oh!

Uh oh!

tzaeschke May 22, 2026

Choose a reason for hiding this comment

Uh oh!

tzaeschke May 22, 2026

Choose a reason for hiding this comment

Uh oh!

nicorusti May 22, 2026

Choose a reason for hiding this comment

Uh oh!

nicorusti May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tzaeschke May 22, 2026

Choose a reason for hiding this comment

Uh oh!

nicorusti May 22, 2026

Choose a reason for hiding this comment

Uh oh!

nicorusti May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nicorusti May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nicorusti commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tzaeschke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nicorusti commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nicorusti commented Apr 30, 2026 •

edited

Loading

nicorusti May 22, 2026 •

edited

Loading

nicorusti May 22, 2026 •

edited

Loading

nicorusti commented May 22, 2026 •

edited

Loading