Subject: Re: defining extension

From: [email-masked] (Peter Gutmann)
Date: Thu, 23 May 2002 14:24:48 +1200 (NZST)

Peter Sylvester <[email-masked]> writes:

>can some tell me what in the 2002 versions of X.6XX the XXX {DER, CER, BER,
>XER, PER) encoding of an OCTET STRING defined with a constraint like
>
>     xxx         OCTET STRING ( CONTAINING abc )
>
>is? Does it mean that the value should/must be encoded using the same encoding
>rules as the data that contain an instance of xxx?

It's a nice way of formalising the old OCTET STRING hole practice.  Instead
of:

  foo OCTET STRING -- Contains a fooValue

which is impossible to process automatically by an ASN.1 compiler/processor
(unless you use a proprietary compiler hack like "--* compiler-directive" to
specify the semantics), you say:

  foo OCTET STRING ( CONTAINING fooValue )

Since OCTET STRINGs are (occasionally) used to hold blobs in other encoding
formats (and I'm not aware of any in PKI, but for other messaging types there'd
be legacy encodings present) you can also say:

  foo OCTET STRING ( CONTAINING fooValue ENCODED BY legacyEncodingFormat )

Peter.