Subject: FW: DER encoding of OPTIONAL sequences with nothing

From: "Ambarish Malpani" <[email-masked]>
Date: Mon, 4 Oct 1999 11:51:17 -0700

Hi PKIX-land,
    Just learnt something of the ASN.1 mailing list that I
think will be of general interest.

In a nutshell, try not to have definitions like:

 Top ::= SEQUENCE {
     i    INTEGER,
     something [0] EXPLICIT SEQUENCE OF Foo OPTIONAL
 }

but do them as:

 Top ::= SEQUENCE {
     i    INTEGER,
     something [0] EXPLICIT SEQUENCE SIZE (1..MAX) OF Foo OPTIONAL
 }

This prevents you from allowing 2 different DER encodings of a
single object.

Please ignore the mail if this was obvious.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043-1833

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Ambarish Malpani
> Sent: Monday, October 04, 1999 10:35 AM
> To: [email-masked]
> Subject: RE: DER encoding of OPTIONAL sequences with nothing
> 
> 
> 
> Hi John,
>     Okay, that clarifies the issue.
> 
> Next time, I will make sure I specify top as:
> 
> Top ::= SEQUENCE {
>     i    INTEGER,
>     something [0] EXPLICIT SEQUENCE SIZE (1..MAX) OF Foo OPTIONAL
> }
> 
> Some people do it this way and I had never figured out why.
> 
> Thanks,
> Ambarish
> 
> ---------------------------------------------------------------------
> Ambarish Malpani
> Architect                                                650.567.5457
> ValiCert, Inc.                                  [email-masked]
> 1215 Terra Bella Ave.                         http://www.valicert.com
> Mountain View, CA 94043-1833
> 
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of John Larmouth
> > Sent: Saturday, October 02, 1999 3:20 AM
> > To: [email-masked]
> > Subject: Re: DER encoding of OPTIONAL sequences with nothing
> > 
> > 
> > I am afraid we need to discuss angels on pin-heads here!  
> The issue is
> > the set of abstract values in Top.  DER guarantees a unique 
> > encoding for
> > each separate abstract value,  but equally an application can put
> > different semantics on different abstract values,  so all abstract
> > values in the type have to have different endcodings.
> > 
> > In the case of an OPTIONAL element (or whatever type),  ASN.1 
> > takes the
> > view that a SEQUENCE value with an OPTIONAL element present is a
> > different abstract value (carries different semantics) from 
> > one where it
> > is absent.
> > 
> > This is quite clearly correct in the general case.  It just looks a
> > little funny in the case that you quote!
> > 
> > So the principle is that a value of Top with something missing is a
> > distinct abstract value (and may carry different semantics) 
> > from a value
> > with something present as an empty sequence of.  DER 
> therefore allows
> > (has to allow) different encodings for the two cases.
> > 
> > John L
> > 
> > 
> > Ambarish Malpani wrote:
> > > 
> > > Hi Guys,
> > >     A question was raised in the IETF PKIX working group that
> > > would benefit from some input from this group.
> > > 
> > > If I define
> > > 
> > > Top ::= SEQUENCE {
> > >     i    INTEGER,
> > >     something [0] EXPLICIT SEQUENCE OF Foo OPTIONAL
> > > }
> > > 
> > > And I am trying to do a DER encoding of a top, where the
> > > something contains no Foo's, is the right encoding to not put any
> > > bytes, or to encode it as a tag 0, length 2, and sequence
> > > of length 0?
> > > 
> > > Is this a bug in the DER encoding rules (which promise a unique
> > > encoding), or is the correct encoding specified in the rules?
> > > 
> > > Regards,
> > > Ambarish
> > > 
> > > 
> > 
> ---------------------------------------------------------------------
> > > Ambarish Malpani
> > > Architect                                                
> > 650.567.5457
> > > ValiCert, Inc.                                  
> > [email-masked]
> > > 1215 Terra Bella Ave.                         
> http://www.valicert.com
> > Mountain View, CA 94043-1833
> 
> -- 
> ==============================================================
> ==========
>                           Prof John Larmouth
>    1 Blueberry Road,  Bowdon,  Altrincham,  Cheshire WA14 
> 3LS,  England.
>      j.larmouth @ salford.ac.uk              Tel: +44 161 928 1605
>         Fax (work): +44 161 745 8169  Tel (work): +44 161 295 5657
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
> - - - - -
> 
>

---

From: Magnus Nystrom <[email-masked]>
Date: Tue, 5 Oct 1999 08:57:42 +0200 (W. Europe Daylight Time)

Hi Ambarish,

On Mon, 4 Oct 1999, Ambarish Malpani wrote:

[...] 
>      something [0] EXPLICIT SEQUENCE SIZE (1..MAX) OF Foo OPTIONAL

But why the [0] EXPLICIT? The tags (INTEGER, SEQUENCE) are unique anyway.

-- Magnus
Magnus Nystrom		Email: [email-masked]
RSA Laboratories

---

From: "Ambarish Malpani" <[email-masked]>
Date: Wed, 6 Oct 1999 16:31:11 -0700

This is mainly a style issue. I prefer tagging anything that is
part of a choice, so that if, in the future, somebody else adds
another thing in there, they don't screw it up by mistake.

You are absolutely right - the tag isn't required.

Regards,
Ambarish

> From: Magnus Nystrom [mailto:[email-masked]]
> Sent: Monday, October 04, 1999 11:58 PM
> To: Ambarish Malpani
> Cc: [email-masked]
> Subject: Re: FW: DER encoding of OPTIONAL sequences with nothing
> 
> 
> 
> Hi Ambarish,
>