Re: [saag] ASN.1 vs. DER Encoding

[Peter Gutmann <[e-mail]>]

Nico Williams <[e-mail]> writes:

>A protocol using ASN.1 BER/DER/CER with IMPLICT tagging will lose some type
>information, so while you can check a lot of an encoded message's validity
>without reference to its schema, you cannot check all of it.

You can check it, you just need to use heurstics.  That's what dumpasn1 does,
it's aware of the situations in which there's encapsulation and can dig down
into both implicit-tagged data and hole encodings.

(Don't look at the code, it's full of hacks to handle broken encodings and
display things in twenty different custom ways, so it's not representative of
what a decoder should look like).

>Whereas if you have reference to its schema, then you can check all of it
>regardless of whether the encoding rules are TLV or not.

And that's the problem, you need to have the schema for the latest version of
every possible protocol you're likely to examine, and update the code every
time anything anywhere changes.  With a self-describing data type, you only
need to write the format firewall once and it'll work indefinitely.  I've been
using the same ASN.1 firewall code for over fifteen years...

Peter.