Subject: Decoding Service Support

From: "Brian G. Holmes" <[email-masked]>
Date: Thu, 08 Apr 2004 16:03:48 -0400

PKIX Discussion List Members...

I am writing to you in order to determine whether or not I should 
invest more of my time to support the PKIX family of protocols.

I support a free BER for ASN.1 decoding service known as the Berasno 
Decoding Service.  The service was originally established for decoding 
the GSM MAP and ITU TCAP protocols.  Now I am looking for other 
protocols to support.

I am new to the PKIX family of protocols.  In my investigation of RFC 
3280, I found that the protocol has a straight-forward ASN.1 
definition.  It appears that there would be a need to support 
Extensions based on OID; that functionality would be very similar to 
one used to identify GSM MAP information within TCAP.  I may also be 
able to support protocols like the one defined in 
draft-ietf-pkix-tap-00.txt (using RFCs 3280, 3281, 3161, 3369, and 2510).

I am looking for guidance.  I need your opinions, and some sample 
data.  I want the Berasno Decoding Service to be used, so I am looking 
for ways to make it useful.  What protocols would you like to see 
supported?  What information would you like to see presented?  Do you 
have a favorite decode report format?  Should the service support 
Base64 as an input data format?

Thank you for your time.

...Brian

NOTE:  If this is an inappropriate topic for discussion on this list 
then please let a list administrator say so ASAP.  Of course, you are 
welcome to send your responses directly to me.

-- 
Holmespun Solutions, LLC
http://www.holmespun.biz
919-844-7713

---

From: [email-masked] (Peter Gutmann)
Date: Sun, 11 Apr 2004 03:02:32 +1200

"Brian G. Holmes" <[email-masked]> writes:

>I support a free BER for ASN.1 decoding service known as the Berasno Decoding
>Service.

How is this different from something like dumpasn1?

Peter.

---

From: "Brian G. Holmes" <[email-masked]>
Date: Sun, 11 Apr 2004 18:43:49 -0400

The dumpasn1 tool is similar to the 'decode ber' functionality 
provided by the Berasno service.  The 'decode ber' function provides 
information extracted only from the data; the structure encoded there.

http://www.holmespun.biz/berasno/example/index.html

The Berasno service is capable of providing much more.  Please see the 
examples displayed at the address above.  The 'decode ietf snmp', 
'decode itu tcap', and 'decode gsm map' functions are able to name the 
elements (the TLVs) that are found within the data.

Consider the certs/DSAParametersInheritedCACert.crt certificate from 
NIST's PKITS_data.zip test data file.

Where the 'decode ber' function would tell us that the 0x30 tag at 
offset 4 represents a [UNIVERSAL 16] SEQUENCE, a 'decode x509' 
function would strive to identify that element as an instance of a 
PKIX1Explicit88.Certificate.tbsCertificate.

Where the 'decode ber' function would tell us that the 0xA3 tag at 
offset 349 represents an [APPLICATION 3] SEQUENCE, a 'decode x509' 
function would strive to identify that element as an instance of 
PKIX1Explicit88.Certificate.tbsCertificate.extensions.

As I alluded to in my previous message, the 'decode gsm map' function 
extends the identification of elements from one layer (TCAP) using OID 
information to do the same for a second/nested layer (MAP).  The 
'decode x509' function would likely do the same for certificate 
extensions.

I envision supporting additional input formats, and providing 
additional output formats, to meet the needs of the users of the 
service.  One improvement would see value decoding for primitives 
whose tags are not UNIVERSAL.  Another improvement that I would like 
to introduce would be to produce output using a Basic XER (XML) 
format; a format that may be easier to read than the one currently in use.

BGH

-- 
Holmespun Solutions, LLC
http://www.holmespun.biz
919-844-7713