1 Apr 1997 02:50
Re: Distinguished names and X509v3 extension OIDs (fwd)
Warwick Ford <wford <at> verisign.com>
1997-04-01 00:50:51 GMT
1997-04-01 00:50:51 GMT
We certainly looked first at the more obvious options such as ANY DEFINED
BY and EXTERNAL but were forced to reject them. I think what you are
saying you would prefer is essentially the ANY DEFINED BY option, i.e., (in
shorthand) SEQUENCE { oid, boolean, ANY DEFINED BY oid }. (Actually this
would be done using table notation, but most readers probably are more
familiar with ANY DEFINED BY.)
>From recollection, the problem with the ANY DEFINED BY approach is as
follows. Recall that a certificate is not necessarily transmitted
everywhere encoded in DER. Some certificate-carrying protocols use
BER-encoding. This is why a cert using system may need to regenerate the
DER encoding of the cert when verifying the signature. Recall also that
intermediate systems through which a cert traverses may decode and recode
certs differently (e.g., if BER is in use, a system may re-encode a cert
with a different BER encoding than that in which it was received). In the
case of an extension, such a change of encoding might occur in any system
that recognizes the extension OID and the corresponding ASN.1 type for the
extension value.
Now, when it comes to validating a cert, note that certs that contain
unrecognized extensions may still be perfectly valid and usable (provided
every unrecognized extension is flagged noncritical). But, if it is
possible for the bit-representation of an unrecognized extension to have
changed in transit, how can the cert-using system generate the required
canonical encoding to verify the cert's signature?
The level of indirection gained through the OCTET STRING overcomes this
problem. Intermediate systems are not permitted to change the encoding of
an extension at the inner level, since it is mandated to always be DER.
And changing the encoding of the octet string itself is not a problem as
(Continue reading)
I noticed that many of the X.520 Selected attributes are of type DirectoryString
which in turn is a choice of teletexString, printableString and universalString.
Does anybody know when which Form is to be used and wether a transformation
between these types (if possible) is allowed and gives equal meaning.
Of course, if it's within a SIGNED context then the answer is clear:
one can't change the types. But in other cases?
read you later - Holger Reif
---------------------------------------- Signaturprojekt Deutsche Einheit
TU Ilmenau - Informatik - Telematik (Verdamp lang her)
Holger.Reif <at> PrakInf.TU-Ilmenau.DE Alt wie ein Baum werden, um ueber
RSS Feed