Support longer X.667 UUID based OIDs (2.25.xxx)

[Eugeny]

https://www.itu.int/ITU-T/studygroups/com17/oid/X.667-E.pdf

X.667 suggests the 2.25 namespace for use with self-assigned OIDs based on UUIDs. The arc size under 2.25 is 128 bits which is longer than what const_oid supports, making it impossible to use const_oid with "self-registered" OIDs

[tarcieri]

Do you have a specific use case in mind, or is this a request to support them for the sake of supporting them?

Note that we currently document not supporting these is a deliberate decision, citing a survey of what other implementations have chosen to support: https://docs.rs/const-oid/0.10.1/const_oid/type.Arc.html

[Eugeny]

Yes - using them in subjectAlternateName field when issuing certificates with x509-cert

[tarcieri]

We've already shipped v0.10, so you're asking for a breaking change.

Is supporting it worth making everyone else use pub type Arc = u128? I'm not so sure.

I'll again note that most OID libraries don't support this. Have you actually tested such certificates in the wild with the clients you intend to use to ensure they work as expected?

[tarcieri]

One way they could potentially be supported is by making the Arcs iterator generic over various iterator types, so u128 could potentially be supported.

Making that work would probably also require making that type a phantom parameter of ObjectIdentifier since it's needed to validate the OID is well-formed.

[Eugeny]

I'm still on it, but using vendor OIDs seems to be the accepted way of having a custom "user ID" cert attribute beyond stuffing it into the DN.

Arc sizes are not an issue when using an officially allocated OID but I'm assuming it's not something you can just easily get