Subject: What is 20 octets ?

From: "Wahaj" <[email-masked]>
Date: Fri, 6 Feb 2004 20:39:01 +0500

Hi All,

In RFC 3280 Section 4.1.2.2  Serial number, it is defined that the Conformant CAs MUST NOT use serialNumber values longer than 20 octets. Can any one explain what 20 octets mean ? Does it mean 20 characters long Serial number in hex e.g. FFFFFFFFFFFFFFFFFFFF ? Similar is the case for CRL Number.

Thanks,
Wahaj

---

From: Jack Lloyd <[email-masked]>
Date: Fri, 6 Feb 2004 11:39:10 -0500 (EST)

octet = byte. 20 octets = 20 bytes. That means (basically), that:
 0 <= serialNumber < 2**160
  -J

On Fri, 6 Feb 2004, Wahaj wrote:

> Hi All,
> 
> In RFC 3280 Section 4.1.2.2 Serial number, it is defined that the
> Conformant CAs MUST NOT use serialNumber values longer than 20 octets.
> Can any one explain what 20 octets mean ? Does it mean 20 characters long
> Serial number in hex e.g. FFFFFFFFFFFFFFFFFFFF ? Similar is the case for
> CRL Number.
> 
> Thanks,
> Wahaj
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 06 Feb 2004 13:42:25 -0500

Wahaj:

When you DER encode the serial number, the value portion MUST NOT exceed 20 
octets.

Russ

At 08:39 PM 2/6/2004 +0500, Wahaj wrote:
>Conformant CAs MUST NOT use serialNumber values longer than 20 octets. Can 
>any one explain what 20 octets mean ? Does it mean 20 characters long

---

From: Dr Stephen Henson <[email-masked]>
Date: Fri, 06 Feb 2004 19:43:30 +0000

>  0 <= serialNumber < 2**160

Since the MSB of an ASN1 INTEGER is the sign bit and the serialNumber 
must be non-negative its actually:

0 <= serialNumber < 2^159

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.