Subject: Re: [pkix] ASN.1 expression of extensions with absent extension value

From: Peter Gutmann <[email-masked]>
Date: Mon, 28 Jan 2013 23:56:24 +0000

Russ Housley <[email-masked]> writes:

>Peter's ASN.1 dumper is one example.

I should point out that dumpasn1 goes to great lengths to decode anything it
can, no matter how... creatively it's encoded (for example it does content
sniffing of typical hole values like BIT STRING and OCTET STRING and decodes
opaque contents if they're also ASN.1), so the fact that dumpasn1 will display
something doesn't mean that anything else can (or even should) decode it.

Peter.

---

From: Michael StJohns <[email-masked]>
Date: Mon, 28 Jan 2013 19:13:44 -0500

Hi Peter - 

As I see it, your tool is the equivalent of an XML parser without support for schema or DTD checking.  It may be well formed ASN1, and your tool will parse it, but the tool doesn't know - for example - that its parsing a certiificate and that it should ensure the OCTET STRING in an extension *also* needs to contain well formed ASN1.  To get around this lack of knowledge (and to make the tool more useful), any time you see an OCTET STRING, you attempt to parse its contents as ASN1, but you don't count it an error if it doesn't parse.

Correct?

Mike

;At 06:56 PM 1/28/2013, Peter Gutmann wrote:
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix