Re: [pkix] Interoparability problem between RFC 5280 and EDIFACT

[koichi sugimoto <[e-mail]>]

Hello Peter,

You mean the application has a bug?
If the application is compliant to RFC 5280, then, the application
must be able to handle 20 octets.
Therefore, the encoding function that generates the 'CERTIFICATE
REFERENCE' should convert
5 octets to less than 9 charcters.
For example, base64 is one of the most familiar encoding, that
converts 3 octets to 4 characters.
It meets the requirement?

Regards,
Koichi Sugimoto.

2011/12/13 Peter Gutmann <[e-mail]>:
> koichi sugimoto <[e-mail]> writes:
>
>>On the other hand, EDIFACT specifies the length of the 'CERTIFICATE  REFERENCE'
>>must be less than or equal to 35 characters.
>>In this case,
>>'11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff 00 11 22'
>>cannot be accptable to EDIFACT.
>
> That spec was written with EDIFACT certificates in mind; the only thing they
> have in common with X.509 is that both use the word "certificates".  So you
> will run into problems because you're using the fields to convey information
> that they were never designed to convey.  The solution is to apply whatever
> kludge works:
>
> - Convince the CA to user shorter serial numbers (given your email address,
>  I'm assuming your organisation is the CA, so you'd just have to change your
>  software to use shorter serial numbers).
> - Have your app recognise truncated forms of the reference string.
> - Stuff additional bits of the value into other, optional fields.
> - Change the encoding to allow a higher encoding density.
> - ...
>
> Peter.