Re: [security-services] the "NotOnOrAfter" issue

[Stephen Farrell <stephen.farrell@baltimore.ie>]

Phill,

> To put it another way, Steve has a problem because X.509 is confused and
> broken.

Nope. I've a problem with what I see as gratuitous "improvement". As you 
point out, getting X.509 implementations to do the right/same thing with
time values did take a long time (though not for the reason you mentioned, 
it was mostly to do with DER and the inclusion, or not, of "00" seconds 
values). I'd rather not revisit all that type of thing again, (which we may 
if we change the semantics as proposed), just for the sake of "purity". 

However, I should point out that I think this isn't the worst thing 
about the handling of time in the -25 spec: the lack of direction on 
timezones, fractional seconds and comparisons is IMO *much* worse. This
is just the icing on the cake. (BTW: even if there's some other xml 
spec that does include all the relevant rules, I'd argue to copy those
that we want applied into the saml core in any case.)

> The problem with the X.509 approach is that it requires a very peculiar
> interpretation of the NotAfter time. Say we have 23:59:59, we have to
> consider the cert valid on 23:59:59.00 which is expected but also
> 23:59:59.01 which is not.

Sorry, but I'd expect this, given that in X.509/2459 notAfter is quite
clearly declared to have a granularity of exactly one second. There is no 
choice about that so there is no ambiguity (if you think there is, then 
send a post to the pkix list & have a nice long discussion there:-).

So, given that X.509 related time values are, by definition, in seconds,
the two schemes are then:

SAML
         if ( NotBefore <= time AND time < NotOnOrAfter)

X.509
         if ( notBefore <= time AND time <= notAfter)

How many programmers are going get the inclusion/exclusion of that 2nd
"=" sign wrong? That's what I care about.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:stephen.farrell@baltimore.ie
Ireland                             http://www.baltimore.com