Subject: Re: [saag] I-D on PKCS#11 URI Scheme for naming objects

From: Stef Walter <[email-masked]>
Date: Sun, 01 Aug 2010 08:35:25 +0200

I work on gnome-keyring which is based around PKCS#11. We're working on
an effort to use PKCS#11 as a common key and certificate storage
standard for the GNOME Desktop.

I'm interested in the PKCS#11 URI [1] RFC that you proposed. However,
several questions come up about encoding.

The standard states that semi-colons and backslashes should be escaped
with back slashes. That fixes the problem of allowing semi-colons to be
specified in object=xxx labels.

However if there are spaces, tabs, or other special characters in the
PKCS#11 URI should these be percent encoded? This is not made clear in
the spec, but perhaps it's an assumption because of the reference to
other URI RFCs.

That said, one implementation I found in OpenSolaris libcryptoutil does
not handle percent encoding or even the backslash style escaping [2].

I question the need for backslash style escaping of semi-colon
suggested in the PKCS#11 URI proposal. In my opinion PKCS#11 URIs should
just use percent encoding for semi-colons, similar to how you would
percent encode a '?' character or space in a http: URL.

Secondly, would it perhaps make sense to use percent encoding for the
id= attribute? PKCS#11 URIs as proposed are introducing a colon style
encoding. I noticed it's not defined whether there may be one hex
character between colons or not. Percent encoding is a well defined
encoding which removes such ambiguities.

Looking forward to your comments.

Cheers,

Stef

[1] http://tools.ietf.org/html/draft-pechanec-pkcs11uri-01

[2]
http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/libcryptoutil/common/pkcs11_uri.c#126