Subject: SkipCerts encoding

From: Paul Nelson <[email-masked]>
Date: Mon, 14 May 2007 17:01:54 -0500

I'm not an ASN.1 expert.  I have a certificate that contains:

 478   12:         SEQUENCE {
 480    3:           OBJECT IDENTIFIER policyConstraints (2 5 29 36)
 485    5:           OCTET STRING, encapsulates {
 487    3:             SEQUENCE {
 489    1:               [0] 04
         :               }
         :             }
         :           }

As decoded by the dumpasn1 utility.  In hex, the PolicyConstraints is
encoded as:

30 03 80 01 04

Is this a valid encoding?  Shouldn't PolicyConstraints be encoded like this:

30 05 80 03 02 01 04 ??

This is the encoding from RFC 3280:

PolicyConstraints ::= SEQUENCE {
     requireExplicitPolicy           [0] SkipCerts OPTIONAL,
     inhibitPolicyMapping            [1] SkipCerts OPTIONAL }

SkipCerts ::= INTEGER (0..MAX)

Paul Nelson
Thursby Software Systems, Inc.

---

From: "Mark Ennis" <[email-masked]>
Date: Tue, 22 May 2007 08:19:37 +1000

Paul,

The PolicyConstraints type is defined in the PKIX1Implicit88 ASN.1
module which is marked as "IMPLICIT TAGS". Therefore, the encoding you
encountered is correct and the encoding you propose assumes "EXPLICIT
TAGS".

- Mark.