Re: [pkix] Signature Verification and DER requirements

As Peter states. It is confusing, and I am not sure how to get it right.

RFC 5280 in 4.1 say: For signature calculation, the data that is to be
signed is encoded using the ASN.1 distinguished encoding rules (DER). This
sentence could be read that the certificate when transmitted does not have
to be DER encoded.

Both RFC 5280 and X.509 requires an extension, which is encapsulated in  an
octet string, to be DER encoded.

We tried to make the DER encoding mandatory in a technical corrigendum, but
we got a ballot comment from Japan saying:

"The proposed change will break the backward
compatibility.
In the current (from the first to the seventh)
edition, the TBSCertificate data type may be
encoded using the BER, if it is temporally
encoded using the DER during the HASH and the
ENCRYPTED-HASH calculation.
The mandate of DER encoding will exclude such
certificates."

The Japene comment suggested the following text:

"It shall be encoded using the BER or the DER,
though the DER encoding is required when the
validation of SIGNED type is performed. It is
(strongly) recommended to use the DER at all
times, if no attention to the backward compatibility
with the earlier editions of this specification is
necessary."

Since 1997 the following has been included in X.509.

"Generating distinguished encoding requires the abstract syntax of the data
to be encoded to be fully understood. An entity may be required to sign data
or check the signature of data that is already signed or contains unknown
protocol extensions or unknown attribute syntaxes. The entity shall follow
these rules:
	It shall preserve the encoding of received information whose
abstract syntax it does not fully know and which it expects to subsequently
sign.
	When signing data for sending, it shall send data whose syntax it
fully knows with a distinguished encoding and any other data with its
preserved encoding, and shall sign the actual encoding it sends.
	When checking signatures in received data, it shall check the
signature against the actual data received rather than its conversion of the
received data to a distinguished encoding."

This text seems to assume that a certificate shall always be DER encoded

I am interested in comments.

Kind regards,

Erik

-----Oprindelig meddelelse-----
Fra: pkix [mailto:pkix-bounces@ietf.org] På vegne af Peter Gutmann
Sendt: 14 May 2015 19:58
Til: IETF PKIX
Emne: Re: [pkix] Signature Verification and DER requirements

Jeffrey Walton <noloader@gmail.com> writes:

>What is the expected behavior when complying software that expects DER 
>consumes a non-DER encoded certificate during signature verification?

The expected behaviour is random, some will accept it, some will reject it.
When I say "random" I mean it really is a coin-toss, you should be OK with
not sorting the attributes in a SET OF, but there are implementations out
there that check for it and will complain about it.  My code sorts (in order
to deal with said implementations), but doesn't check for sortedness when
processing things.

Peter.
_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix