Subject: Re: DER encoding of OPTIONAL sequences with nothing

From: "ani" <[email-masked]>
Date: Wed, 6 Oct 1999 10:24:14 +0530

It is incorrect to say that this prevents 2 different DER encodings of a
*single object*. It is actually not a single object. The fact of an empty
SEQUENCE being present makes it a different object than the SEQUENCE being
absent. And DER, correctly, allows two different encodings to represent
these two data objects. It is worth noting that the the above two objects
could convey different meanings to the application looking at the encodings.

So, in general, there is nothing wrong with the first ASN.1 definition. The
ASN.1 toolset which an application developer uses should have the ability to
allow the developer to represent these two objects separately. For example,
if the toolset generates equivalent 'C' structures, the generated 'C'
structure should have a provision for specifying the empty SEQUENCE and an
absent SEQUENCE differently.

As an aside, another way of "disambiguating" the ASN.1 structure is to write
it as:

Top ::= SEQUENCE {
    i    INTEGER,
    something [0] EXPLICIT SEQUENCE OF Foo
}

Of course, as Magnus Nystrom put it, all the above arguments would hold even
if [0] EXPLICIT was not present.

Regards,

Ani

-------------------------------------------
Aniruddha P. Shrotri (ani)
VP, Software Development, E-Lock Technologies Inc.
[email-masked]
http://www.elock.com
-------------------------------------------

----- Original Message -----
From: Ambarish Malpani <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, October 05, 1999 12:21 AM
Subject: FW: DER encoding of OPTIONAL sequences with nothing

>
> Hi PKIX-land,
>     Just learnt something of the ASN.1 mailing list that I
> think will be of general interest.
>
> In a nutshell, try not to have definitions like:
>
>  Top ::= SEQUENCE {
>      i    INTEGER,
>      something [0] EXPLICIT SEQUENCE OF Foo OPTIONAL
>  }
>
> but do them as:
>
>  Top ::= SEQUENCE {
>      i    INTEGER,
>      something [0] EXPLICIT SEQUENCE SIZE (1..MAX) OF Foo OPTIONAL
>  }
>
>
> This prevents you from allowing 2 different DER encodings of a
> single object.
>
> Please ignore the mail if this was obvious.
>
> Regards,
> Ambarish
>
>
> ---------------------------------------------------------------------
> Ambarish Malpani
> Architect                                                650.567.5457
> ValiCert, Inc.                                  [email-masked]
> 1215 Terra Bella Ave.                         http://www.valicert.com
> Mountain View, CA 94043-1833
>
>
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On Behalf Of Ambarish Malpani
> > Sent: Monday, October 04, 1999 10:35 AM
> > To: [email-masked]
> > Subject: RE: DER encoding of OPTIONAL sequences with nothing
> >
> >
> >
> > Hi John,
> >     Okay, that clarifies the issue.
> >
> > Next time, I will make sure I specify top as:
> >
> > Top ::= SEQUENCE {
> >     i    INTEGER,
> >     something [0] EXPLICIT SEQUENCE SIZE (1..MAX) OF Foo OPTIONAL
> > }
> >
> > Some people do it this way and I had never figured out why.
> >
> > Thanks,
> > Ambarish
> >
> > ---------------------------------------------------------------------
> > Ambarish Malpani
> > Architect                                                650.567.5457
> > ValiCert, Inc.                                  [email-masked]
> > 1215 Terra Bella Ave.                         http://www.valicert.com
> > Mountain View, CA 94043-1833
> >
> >
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]]On Behalf Of John Larmouth
> > > Sent: Saturday, October 02, 1999 3:20 AM
> > > To: [email-masked]
> > > Subject: Re: DER encoding of OPTIONAL sequences with nothing
> > >
> > >
> > > I am afraid we need to discuss angels on pin-heads here!
> > The issue is
> > > the set of abstract values in Top.  DER guarantees a unique
> > > encoding for
> > > each separate abstract value,  but equally an application can put
> > > different semantics on different abstract values,  so all abstract
> > > values in the type have to have different endcodings.
> > >
> > > In the case of an OPTIONAL element (or whatever type),  ASN.1
> > > takes the
> > > view that a SEQUENCE value with an OPTIONAL element present is a
> > > different abstract value (carries different semantics) from
> > > one where it
> > > is absent.
> > >
> > > This is quite clearly correct in the general case.  It just looks a
> > > little funny in the case that you quote!
> > >
> > > So the principle is that a value of Top with something missing is a
> > > distinct abstract value (and may carry different semantics)
> > > from a value
> > > with something present as an empty sequence of.  DER
> > therefore allows
> > > (has to allow) different encodings for the two cases.
> > >
> > > John L
> > >
> > >
> > > Ambarish Malpani wrote:
> > > >
> > > > Hi Guys,
> > > >     A question was raised in the IETF PKIX working group that
> > > > would benefit from some input from this group.
> > > >
> > > > If I define
> > > >
> > > > Top ::= SEQUENCE {
> > > >     i    INTEGER,
> > > >     something [0] EXPLICIT SEQUENCE OF Foo OPTIONAL
> > > > }
> > > >
> > > > And I am trying to do a DER encoding of a top, where the
> > > > something contains no Foo's, is the right encoding to not put any
> > > > bytes, or to encode it as a tag 0, length 2, and sequence
> > > > of length 0?
> > > >
> > > > Is this a bug in the DER encoding rules (which promise a unique
> > > > encoding), or is the correct encoding specified in the rules?
> > > >
> > > > Regards,
> > > > Ambarish
> > > >
> > > >
> > >
> > ---------------------------------------------------------------------
> > > > Ambarish Malpani
> > > > Architect
> > > 650.567.5457
> > > > ValiCert, Inc.
> > > [email-masked]
> > > > 1215 Terra Bella Ave.
> > http://www.valicert.com
> > > Mountain View, CA 94043-1833
> >
> > --
> > ==============================================================
> > ==========
> >                           Prof John Larmouth
> >    1 Blueberry Road,  Bowdon,  Altrincham,  Cheshire WA14
> > 3LS,  England.
> >      j.larmouth @ salford.ac.uk              Tel: +44 161 928 1605
> >         Fax (work): +44 161 745 8169  Tel (work): +44 161 295 5657
> > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > - - - - -
> >
> >