RE: [TLS] Re: Comments on draft-housley-tls-authz-extns-07

[<Pasi.Eronen at nokia.com>]

Russ Housley wrote:

> >- The size of authorization data, i.e., X.509 attribute 
> >  certs and SAML assertions, are limited to 64kb.  Is it certain 
> >  that we won't need more?
> 
> I recall responding to this the first time around.  I said that 
> I could not imagine needing 64KB for X.509 Attribute Certificates, 
> but I do not have experience with SAML Assertions.  I know they 
> are bigger, but I do not have any way to gauge the likelihood 
> that 64KB will not be enough.

One relatively simple SAML assertion example from the SAML specs 
is 3.5 KB. If it used 4096-bit RSA keys instead of 1024, and 
included holder-of-key SubjectConfirmation block, it would be 
maybe 6 KB. If it included more complex assertions or additional 
certificates, it could get over 10 KB.

IMHO the safety margin is too small for "64K ought to be enough for
everyone" :-)

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls