Subject: RFC3281 and tagging

From: Juergen Brauckmann <[email-masked]>
Date: Wed, 02 Oct 2002 14:10:19 +0200

Hi.

I see a tagging problem in RFC3281. I hope that I'm wrong; perhaps
someone can have a look at it?

There are already some mails in the list archive regarding this issue
(<http://www.imc.org/ietf-pkix/mail-archive/msg02005.html>), but I still
don't understand it.

The ASN.1 module in Appendix B of RFC3281 has a module default of
"IMPLICIT":
===================================================
   PKIXAttributeCertificate {iso(1) identified-organization(3) dod(6)
                internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
                id-mod-attribute-cert(12)}

      DEFINITIONS IMPLICIT TAGS ::=

      BEGIN
==================================================

My copy of X.509v4 (I admit that I only have draft v7, so I apologise if
that is the source of my confusion) defines the ASN.1 module in Annex A
as:
=====================================================
AuthenticationFramework {joint-iso-itu-t ds(5) module(1)
authenticationFramework(7) 4}
DEFINITIONS ::=
BEGIN
======================================================

Clause 12.2 of X.680 says: The "TagDefault" is taken as "EXPLICIT TAGS"
if it is "empty".

So basically X.509 defines EXPLICIT tags as the module default and
RFC3281 defines IMPLICIT tags. This has some consequences, e.g. for
structures such as "Holder" inside Attribute certificates, which is
defined in AuthenticationFramework from ISO with EXPLICIT tags and in
PKIXAttributeCertificate with IMPLICIT tags.

Where am I wrong?

Regards,
   Juergen

---

From: DUBUISSON Olivier <[email-masked]>
Date: Wed, 02 Oct 2002 16:18:58 +0200

> The ASN.1 module in Appendix B of RFC3281 has a module default of

I can only see a drawback (not a problem) in case the code is
handcrafted (because you cannot reuse code).
When you use an ASN.1 compiler, you don't have to worry, for the 
encoder/decoder are generated according to each ASN.1 module whether it 
includes an IMPLICIT or EXPLICIT tagging mode.
-- 
Olivier DUBUISSON
france telecom R&D

DTL/TAL - 22307 Lannion Cedex - France
t: +33 2 96 05 38 50 - f: +33 2 96 05 39 45 - http://asn1.elibel.tm.fr/

---

From: Juergen Brauckmann <[email-masked]>
Date: Wed, 02 Oct 2002 16:24:30 +0200

> includes an IMPLICIT or EXPLICIT tagging mode.

Yes. I was not talking about code, just about the specification. And if
the specifications do not match, so will the code that the compiler
generates.

Regards,
   Juergen

---

From: "Housley, Russ" <[email-masked]>
Date: Wed, 02 Oct 2002 18:59:18 -0400

RFC 3281 is correct.  Many thanks to Rich Nicholas for performing a quick 
investigation.  Here are the details.

Juergen is referencing the wrong X.509 module.  The attribute certificate 
definitions are defined in the AttributeCertificateDefinitions module, not 
the AuthenticationFramework module.  The AttributeCertificateDefinitions 
module defined in X.509 (2000) uses IMPLICIT tagging, the same tagging used 
in the PKIXAttributeCertificate module defined in RFC 3281.

Russ

---

From: Juergen Brauckmann <[email-masked]>
Date: Fri, 04 Oct 2002 08:02:05 +0200

> in the PKIXAttributeCertificate module defined in RFC 3281.

Thank you for your answer. OK, know I see what I was missing. 

I did not see that X.509v3 defines AttributeCertificates.v1 as being
part of the AuthenticationFramework module (with EXPLICIT tagging), but
X.509v4 has AttributeCertificates.v2 in a separate module with IMPLICIT
tagging.
 
Thanks again,
    Juergen