Subject: Basic Constraints

From: [email-masked]
Date: Mon, 23 Jun 2008 17:14:50 -0300

Hi,

I have a request to issue EE certificates with cA Basic Constraints set to 
false. The RFC 5280 specifies that an EE certificate may have a Basic 
Constraint extension.

"... This extension MAY appear as a critical or non-critical extension in 
end entity certificates."

And it also specifies that the certificate data to be signed should be 
encoded in DER format.

4.1.  Basic Certificate Fields

"...The X.509 v3 certificate basic syntax is as follows.  For signature
   calculation, the data that is to be signed is encoded using the ASN.1
   distinguished encoding rules (DER) [X.690].  ASN.1 DER encoding is a
   tag, length, value encoding system for each element."

In X.690, it is written in Section 11 (Restrictions on BER employed by 
both CER and DER) that default values shall not be included in DER 
encoding. 

"...
11.5 Set and sequence components with default value

The encoding of a set value or sequence value shall not include an 
encoding for any component value which is equal to
its default value.
"

In this case, should an EE certificate have a basic constraints with an 
empty sequence or may I encode an EE certificate with cA set to false and 
no pathLenConstraint? Thanks in advance.

BasicConstraints ::= SEQUENCE {
        cA                                      BOOLEAN DEFAULT FALSE,
                pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

Best Regards,

-- David Reis Jr
_____________________________

 Serasa An Experian Company
 Célula Tecnologias de Certificação Digital
 Analista de Sistemas Jr
 davidjr { at } serasa { dot } com { dot } br

**********************************************************************************
As informações contidas nesta mensagem e no(s) arquivo(s) anexo(s) são 
endereçadas exclusivamente à(s) pessoa(s) e/ou instituição(ões) acima 
indicada(s), podendo conter dados confidenciais, os quais não podem, sob 
qualquer forma ou pretexto, ser utilizados, divulgados, alterados, 
impressos ou copiados, total ou parcialmente, por pessoas não autorizadas. 
Caso não seja o destinatário, favor providenciar sua exclusão e notificar 
o remetente imediatamente.  O uso impróprio será tratado conforme as 
normas da empresa e da legislação em vigor.
Esta mensagem expressa o posicionamento pessoal do subscritor e não 
reflete necessariamente a opinião da Serasa.
**********************************************************************************

---

From: Thomas Pornin <[email-masked]>
Date: Tue, 24 Jun 2008 01:01:06 +0200

>                 pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

In DER, values equal to a DEFAULT clause are supposed to be omitted.
In other words, if you want to encode a cA flag of value FALSE, then
you encode it as nothing, since this is the default value. If you do
not include a path length constraint, then the SEQUENCE will be empty.

	--Thomas Pornin