Peter Hesse | 4 Jun 2008 15:53

Web-based ASN.1 decoding tool available

All,

 

We have recently made available a web-based tool for doing an ASN.1 dump.  It displays the ASCII HEX and the ASN structure, and when you hover over the structure, it highlights the relevant portion of the hex.  (Clicking makes the highlight stick.)

 

Due to PHP’s inefficiency and memory usage during parsing, we have limited it to files 64K and smaller.  Still, it is useful for displaying smaller objects when you don’t have dumpasn1 installed or available.

 

It can be found here: http://geminisecurity.com/features-downloads/tools#fd_5

Click on “Click to try the application” under PHPdumpASN.

 

Enjoy!  Please send me any feedback.

 

--Peter Hesse

 

 Peter Hesse                       pmhesse <at> geminisecurity.com

 Phone: 703-378-5808 x105      Gemini Security Solutions, Inc.

    Visit our relaunched website! http://geminisecurity.com

"A good programmer is someone who always looks both ways before
 crossing a one-way street." --Doug Linder

 

Perez, Aram | 4 Jun 2008 18:03

Re: Web-based ASN.1 decoding tool available

On 6/4/08 6:53 AM, Peter Hesse  wrote:

> All,
>  
> We have recently made available a web-based tool for doing an ASN.1 dump.  It
> displays the ASCII HEX and the ASN structure, and when you hover over the
> structure, it highlights the relevant portion of the hex. (Clicking makes the
> highlight stick.)
>  
> Due to PHP’s inefficiency and memory usage during parsing, we have limited it
> to files 64K and smaller.  Still, it is useful for displaying smaller objects
> when you don’t have dumpasn1 installed or available.
>  
> It can be found here: http://geminisecurity.com/features-downloads/tools#fd_5
> Click on “Click to try the application” under PHPdumpASN.

For Windows, you can also try BERViewer <http://homepage.mac.com/aramperez/berviewer.html>. I haven’t had time to remove the nag dialog box from the Mac version.

Regards,
Aram Perez
Peter Rybar | 5 Jun 2008 15:24
Picon

RE: Web-based ASN.1 decoding tool available


Hi,

Have you any free tools which are not the simple dump of asn1 DER/BER but which also can read a data according
the 1988, 93 ASN.1 Syntax? 
Like default values from DER...

Peter

-----Original Message-----
From: owner-ietf-smime <at> mail.imc.org [mailto:owner-ietf-smime <at> mail.imc.org] On Behalf Of Perez, Aram
Sent: Wednesday, June 04, 2008 6:04 PM
To: PKIX; ietf-smime <at> imc.org
Subject: Re: Web-based ASN.1 decoding tool available

On 6/4/08 6:53 AM, Peter Hesse  wrote:

> All,
>  
> We have recently made available a web-based tool for doing an ASN.1 dump.  It 
> displays the ASCII HEX and the ASN structure, and when you hover over the 
> structure, it highlights the relevant portion of the hex. (Clicking makes the 
> highlight stick.)
>  
> Due to PHP’s inefficiency and memory usage during parsing, we have limited it 
> to files 64K and smaller.  Still, it is useful for displaying smaller objects 
> when you don’t have dumpasn1 installed or available.
>  
> It can be found here: http://geminisecurity.com/features-downloads/tools#fd_5
> Click on “Click to try the application” under PHPdumpASN.

For Windows, you can also try BERViewer <http://homepage.mac.com/aramperez/berviewer.html>
<http://homepage.mac.com/aramperez/berviewer.html> . I haven’t had time to remove the nag dialog
box from the Mac version.

Regards,
Aram Perez

Aram Perez | 5 Jun 2008 16:03
Picon

Re: Web-based ASN.1 decoding tool available

Hi Peter,

Have you any free tools which are not the simple dump of asn1 DER/BER but which also can read a data according the 1988, 93 ASN.1 Syntax?
Like default values from DER...

I'm afraid I do not and I'm not aware of any such tool. To get the default values, you would need the actual ASN.1 (which provides the default values) and the BER/DER data.

BERViewer, Peter Hesse's web tool, Peter Gutmann's dumpasn1 and others similar tools just decode the BER/DER and present it in a "more" human readable form.

Regards,
Aram



Peter



-----Original Message-----
From: owner-ietf-smime <at> mail.imc.org [mailto:owner-ietf-smime <at> mail.imc.org] On Behalf Of Perez, Aram
Sent: Wednesday, June 04, 2008 6:04 PM
To: PKIX; ietf-smime <at> imc.org
Subject: Re: Web-based ASN.1 decoding tool available

On 6/4/08 6:53 AM, Peter Hesse  wrote:

All,

We have recently made available a web-based tool for doing an ASN.1 dump.  It
displays the ASCII HEX and the ASN structure, and when you hover over the
structure, it highlights the relevant portion of the hex. (Clicking makes the
highlight stick.)

Due to PHP’s inefficiency and memory usage during parsing, we have limited it
to files 64K and smaller.  Still, it is useful for displaying smaller objects
when you don’t have dumpasn1 installed or available.

It can be found here: http://geminisecurity.com/features-downloads/tools#fd_5
Click on “Click to try the application” under PHPdumpASN.

For Windows, you can also try BERViewer <http://homepage.mac.com/aramperez/berviewer.html> <http://homepage.mac.com/aramperez/berviewer.html> . I haven’t had time to remove the nag dialog box from the Mac version.

Regards,
Aram Perez




Peter Rybar | 5 Jun 2008 16:35
Picon

RE: Web-based ASN.1 decoding tool available


Hi all,

This one is also nice... 
And somebody could try to use it in online PHP :-) with at least ASN.1 modules which are described in PKIX,
SMIME RFCs.

http://lionet.info/asn1c/

Peter

-----Original Message-----
From: owner-ietf-smime <at> mail.imc.org [mailto:owner-ietf-smime <at> mail.imc.org] On Behalf Of Aram Perez
Sent: Thursday, June 05, 2008 4:03 PM
To: PKIX; ietf-smime <at> imc.org
Subject: Re: Web-based ASN.1 decoding tool available

Hi Peter,

	
	Have you any free tools which are not the simple dump of asn1 DER/BER but which also can read a data according
the 1988, 93 ASN.1 Syntax? 
	Like default values from DER...

I'm afraid I do not and I'm not aware of any such tool. To get the default values, you would need the actual
ASN.1 (which provides the default values) and the BER/DER data.

BERViewer, Peter Hesse's web tool, Peter Gutmann's dumpasn1 and others similar tools just decode the
BER/DER and present it in a "more" human readable form.

Regards,
Aram

	Peter
	
	
	
	-----Original Message-----
	From: owner-ietf-smime <at> mail.imc.org [mailto:owner-ietf-smime <at> mail.imc.org] On Behalf Of Perez, Aram
	Sent: Wednesday, June 04, 2008 6:04 PM
	To: PKIX; ietf-smime <at> imc.org
	Subject: Re: Web-based ASN.1 decoding tool available
	
	On 6/4/08 6:53 AM, Peter Hesse  wrote:
	
	

		All,
		

		We have recently made available a web-based tool for doing an ASN.1 dump.  It 
		

		displays the ASCII HEX and the ASN structure, and when you hover over the 
		

		structure, it highlights the relevant portion of the hex. (Clicking makes the 
		

		highlight stick.)
		

		Due to PHP’s inefficiency and memory usage during parsing, we have limited it 
		

		to files 64K and smaller.  Still, it is useful for displaying smaller objects 
		

		when you don’t have dumpasn1 installed or available.
		

		It can be found here: http://geminisecurity.com/features-downloads/tools#fd_5
		

		Click on “Click to try the application” under PHPdumpASN.
		

	For Windows, you can also try BERViewer <http://homepage.mac.com/aramperez/berviewer.html>
<http://homepage.mac.com/aramperez/berviewer.html> . I haven’t had time to remove the nag dialog
box from the Mac version.
	
	Regards,
	Aram Perez
	
	
	
	

Ricardo Barroso | 5 Jun 2008 19:14

Re: Web-based ASN.1 decoding tool available

Hi all!

I would like to mention ASN.1 Editor 
<http://lipingshare.com/Asn1Editor/> (for Windows) which is not a 
web-based tool and although it can't provide default values from DER,
it lets you:
    - inspect ASN.1 structures and encapsulate parts of the structures 
in a more user-friendly way than simple dump tools;
    - edit ASN.1 structures;
    - save sub-parts/structures to a new file;
    - etc.

It also includes a simple but nice data converter between PEM, HEX and 
BASE64 formats.

Best regards,
Ricardo Barroso

Aram Perez wrote:
> Hi Peter,
>>
>> Have you any free tools which are not the simple dump of asn1 DER/BER 
>> but which also can read a data according the 1988, 93 ASN.1 Syntax?
>> Like default values from DER...
>
> I'm afraid I do not and I'm not aware of any such tool. To get the 
> default values, you would need the actual ASN.1 (which provides the 
> default values) and the BER/DER data.
>
> BERViewer, Peter Hesse's web tool, Peter Gutmann's dumpasn1 and others 
> similar tools just decode the BER/DER and present it in a "more" human 
> readable form.
>
> Regards,
> Aram
>
>>
>>
>> Peter
>>
>>
>>
>> -----Original Message-----
>> From: owner-ietf-smime <at> mail.imc.org 
>> [mailto:owner-ietf-smime <at> mail.imc.org] On Behalf Of Perez, Aram
>> Sent: Wednesday, June 04, 2008 6:04 PM
>> To: PKIX; ietf-smime <at> imc.org <mailto:ietf-smime <at> imc.org>
>> Subject: Re: Web-based ASN.1 decoding tool available
>>
>> On 6/4/08 6:53 AM, Peter Hesse  wrote:
>>
>>> All,
>>>
>>> We have recently made available a web-based tool for doing an ASN.1 
>>> dump.  It
>>> displays the ASCII HEX and the ASN structure, and when you hover 
>>> over the
>>> structure, it highlights the relevant portion of the hex. (Clicking 
>>> makes the
>>> highlight stick.)
>>>
>>> Due to PHP’s inefficiency and memory usage during parsing, we have 
>>> limited it
>>> to files 64K and smaller.  Still, it is useful for displaying 
>>> smaller objects
>>> when you don’t have dumpasn1 installed or available.
>>>
>>> It can be found here: 
>>> http://geminisecurity.com/features-downloads/tools#fd_5
>>> Click on “Click to try the application” under PHPdumpASN.
>>
>> For Windows, you can also try BERViewer 
>> <http://homepage.mac.com/aramperez/berviewer.html> 
>> <http://homepage.mac.com/aramperez/berviewer.html> . I haven’t had 
>> time to remove the nag dialog box from the Mac version.
>>
>> Regards,
>> Aram Perez
>>
>>
>>
>

--

-- 
*    Ricardo Barroso* 	

*Telefone:* +351 217 123 010
*Telemóvel:* +351 968 332 327
*Fax:* +351 217 123 011 	*Email:*
ricardo.barroso <at> multicert.com <mailto:ricardo.barroso <at> multicert.com> 
*MULTICERT S.A.*
<http://www.multicert.com>Estrada do Casal do Canas,

<http://maps.google.com/maps?f=q&hl=pt-PT&geocode=&q=Estrada+do+Casal+do+Canas,+Lote+6,+Alfragide+1600-546+Amadora,+Portugal&sll=38.734536,-9.217379&sspn=0.009239,0.023518&ie=UTF8&ll=38.733933,-9.211607&spn=0.073916,0.188141&z=13>
<http://maps.google.com/maps?f=q&hl=pt-PT&geocode=&q=Estrada+do+Casal+do+Canas,+Lote+6,+Alfragide+1600-546+Amadora,+Portugal&sll=38.734536,-9.217379&sspn=0.009239,0.023518&ie=UTF8&ll=38.733933,-9.211607&spn=0.073916,0.188141&z=13> 
Lote 6, Alfragide 
<http://maps.google.com/maps?f=q&hl=pt-PT&geocode=&q=Estrada+do+Casal+do+Canas,+Lote+6,+Alfragide+1600-546+Amadora,+Portugal&sll=38.734536,-9.217379&sspn=0.009239,0.023518&ie=UTF8&ll=38.733933,-9.211607&spn=0.073916,0.188141&z=13>
2720-092 Amadora - Portugal

<http://maps.google.com/maps?f=q&hl=pt-PT&geocode=&q=Estrada+do+Casal+do+Canas,+Lote+6,+Alfragide+1600-546+Amadora,+Portugal&sll=38.734536,-9.217379&sspn=0.009239,0.023518&ie=UTF8&ll=38.733933,-9.211607&spn=0.073916,0.188141&z=13> 

Bob Bell (rtbell | 9 Jun 2008 18:29
Picon
Favicon

RFC 5280 Question

Folks-
 
I am hoping someone can give me the answer to this. Does RFC 5280 adress the case where an end-entity certificate (not a CA cert) is installed in the trust anchor list by the user accepting the presented cert as authoritative and then the cert is subsequently presented (in a later access to the site). There should be no path search, since the presented cert is in the trust anchor list. So, where is it defined to accept the end-entity cert?
 
Thanks ---- Bob
 
Bob Bell
Cisco Systems, Inc.
576 S. Brentwood Ln.
Bountiful, UT 84010
801-294-3034 (v)
801-294-3023 (f)
801-971-4200 (c)
rtbell <at> cisco.com
 
Attachment (smime.p7s): application/x-pkcs7-signature, 3103 bytes
Santosh Chokhani | 9 Jun 2008 19:42
Favicon

RE: RFC 5280 Question

Bob,

 

Neither X.509 nor 5280 explicitly address this.

 

But, one can safely assume that the standards imply that if a trusted certificate public key is required, there is no need for path development and validation.

 

That said, trusting an end certificate could invite security trouble depending on how this trusted certificate is handled.

 

As mentioned below “trust anchor list” could be problematic.  X.509 and 5280 do not require any checks on trust anchors and hence this end certificate could spawn a bogus hierarchy and the PK enabled applications could legitimately accept that hierarchy.

From: owner-ietf-pkix <at> mail.imc.org [mailto:owner-ietf-pkix <at> mail.imc.org] On Behalf Of Bob Bell (rtbell)
Sent: Monday, June 09, 2008 12:29 PM
To: ietf-pkix <at> imc.org
Subject: RFC 5280 Question

 

Folks-

 

I am hoping someone can give me the answer to this. Does RFC 5280 adress the case where an end-entity certificate (not a CA cert) is installed in the trust anchor list by the user accepting the presented cert as authoritative and then the cert is subsequently presented (in a later access to the site). There should be no path search, since the presented cert is in the trust anchor list. So, where is it defined to accept the end-entity cert?

 

Thanks ---- Bob

 

Bob Bell

Cisco Systems, Inc.

576 S. Brentwood Ln.

Bountiful, UT84010

801-294-3034 (v)

801-294-3023 (f)

801-971-4200 (c)

rtbell <at> cisco.com

 

Bob Bell (rtbell | 9 Jun 2008 21:32
Picon
Favicon

RE: RFC 5280 Question

Santosh, et al -
 
I appreciate your response. I agree that there is a potential to have a problem if the acceptance/provisioning of trusted certs is not done securely. However, in this case, we are being very careful with that issue.
 
As to the "spawning a bogus hierarchy", if the cert in the trust list does not have the CA bit set in the usage, then it cannot be used to sign other certs, and thus cannot create this false hierarchy. Is that correct?
 
Bob

From: Santosh Chokhani [mailto:SChokhani <at> cygnacom.com]
Sent: Monday, 09 June, 2008 11:42
To: Bob Bell (rtbell); ietf-pkix <at> imc.org
Subject: RE: RFC 5280 Question

Bob,

 

Neither X.509 nor 5280 explicitly address this.

 

But, one can safely assume that the standards imply that if a trusted certificate public key is required, there is no need for path development and validation.

 

That said, trusting an end certificate could invite security trouble depending on how this trusted certificate is handled.

 

As mentioned below “trust anchor list” could be problematic.  X.509 and 5280 do not require any checks on trust anchors and hence this end certificate could spawn a bogus hierarchy and the PK enabled applications could legitimately accept that hierarchy.

From: owner-ietf-pkix <at> mail.imc.org [mailto:owner-ietf-pkix <at> mail.imc.org] On Behalf Of Bob Bell (rtbell)
Sent: Monday, June 09, 2008 12:29 PM
To: ietf-pkix <at> imc.org
Subject: RFC 5280 Question

 

Folks-

 

I am hoping someone can give me the answer to this. Does RFC 5280 adress the case where an end-entity certificate (not a CA cert) is installed in the trust anchor list by the user accepting the presented cert as authoritative and then the cert is subsequently presented (in a later access to the site). There should be no path search, since the presented cert is in the trust anchor list. So, where is it defined to accept the end-entity cert?

 

Thanks ---- Bob

 

Bob Bell

Cisco Systems, Inc.

576 S. Brentwood Ln.

Bountiful, UT84010

801-294-3034 (v)

801-294-3023 (f)

801-971-4200 (c)

rtbell <at> cisco.com

 

Attachment (smime.p7s): application/x-pkcs7-signature, 3103 bytes
Santosh Chokhani | 9 Jun 2008 22:38
Favicon

RE: RFC 5280 Question

Bob,

 

My primary concern in terms of being very careful is that subscriber keys are not as well protected as CA and undetected compromise becomes a problem.  So, it is not a matter of trusting the subscriber; subscriber could be very trustworthy, but the environment is not likely to be as protected as the CA.

 

On the issue of basic constraints (a.k.a. cA bit), while many of the client may make that check, there is no requirement in X.509 and 5280 to make that check on a trust anchor.

 

From: Bob Bell (rtbell) [mailto:rtbell <at> cisco.com]
Sent: Monday, June 09, 2008 3:32 PM
To: Santosh Chokhani; ietf-pkix <at> imc.org
Subject: RE: RFC 5280 Question

 

Santosh, et al -

 

I appreciate your response. I agree that there is a potential to have a problem if the acceptance/provisioning of trusted certs is not done securely. However, in this case, we are being very careful with that issue.

 

As to the "spawning a bogus hierarchy", if the cert in the trust list does not have the CA bit set in the usage, then it cannot be used to sign other certs, and thus cannot create this false hierarchy. Is that correct?

 

Bob

 

From: Santosh Chokhani [mailto:SChokhani <at> cygnacom.com]
Sent: Monday, 09 June, 2008 11:42
To: Bob Bell (rtbell); ietf-pkix <at> imc.org
Subject: RE: RFC 5280 Question

Bob,

 

Neither X.509 nor 5280 explicitly address this.

 

But, one can safely assume that the standards imply that if a trusted certificate public key is required, there is no need for path development and validation.

 

That said, trusting an end certificate could invite security trouble depending on how this trusted certificate is handled.

 

As mentioned below “trust anchor list” could be problematic.  X.509 and 5280 do not require any checks on trust anchors and hence this end certificate could spawn a bogus hierarchy and the PK enabled applications could legitimately accept that hierarchy.

From: owner-ietf-pkix <at> mail.imc.org [mailto:owner-ietf-pkix <at> mail.imc.org] On Behalf Of Bob Bell (rtbell)
Sent: Monday, June 09, 2008 12:29 PM
To: ietf-pkix <at> imc.org
Subject: RFC 5280 Question

 

Folks-

 

I am hoping someone can give me the answer to this. Does RFC 5280 adress the case where an end-entity certificate (not a CA cert) is installed in the trust anchor list by the user accepting the presented cert as authoritative and then the cert is subsequently presented (in a later access to the site). There should be no path search, since the presented cert is in the trust anchor list. So, where is it defined to accept the end-entity cert?

 

Thanks ---- Bob

 

Bob Bell

Cisco Systems, Inc.

576 S. Brentwood Ln.

Bountiful, UT84010

801-294-3034 (v)

801-294-3023 (f)

801-971-4200 (c)

rtbell <at> cisco.com

 


Gmane