Re: [pkix] OID encoding help

I'm nor sure how CERT RR is solving your problem, but that is not your question.

Since you are using pyasn1...

>>> from pyasn1.type import univ
>>> from pyasn1.codec.der.decoder import decode as der_decoder
>>> from pyasn1.codec.der.encoder import encode as der_encoder
>>> import binascii
>>> oid = univ.ObjectIdentifier('1.3.6.1.4.1.6715.2.6.6')
>>> s = der_encoder(oid)
>>> print(binascii.hexlify(s))
060a2b06010401b43b020606
>>> 

Russ

> On May 7, 2023, at 9:02 AM, Robert Moskowitz <rgm-sec@htt-consult.com> wrote:
> 
> I am asking here, as this seems like a place I can at least get directions on where to ask for help.
> 
> Challenge:  write simple python code to create an OID object.
> 
> Background:
> 
> In draft-ietf-drip-registries, there is a 126-byte RATS-styled Endorsement object call the DRIP Broadcast Endorsement (sec B.3). This object is intended to be available publically via DNS.  For testing and perhaps onwards all we are finding is to use the CERT RR and encode this as a private OID object.  For initial work we will use oid = "1.3.6.1.4.1.6715.2.6.6", with the Endorsement as type BIT-STRING.
> 
> So....
> 
> But I cannot google up any advise on how to do this.  Given how fixed this is, it might even be possible to hand-figure this out and just make the object without involking some python asn1 library. But I am just stuck.
> 
> So can anyone pitch in, or at least point me to some advise postings.
> 
> Oh, I am doing this in F38 which has the python3-pyasn1 libary.
> 
> thanks
> 
> Oh course an 'easier' way would be to extent the TLSA RR to support this type of 'certificate'.  We are already using the TLSA RR for the SPKI we get when we make DETs (rfc 9374).  That is easy, as we get the DER with the keypair generation.  But then this would be a change to TLSA and changes like that to existing RR rarely go well.
> 
> Bob
> 
> 
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix