Re: [saag] ASN.1 vs. DER Encoding

[Yoav Nir <[e-mail]>]

> On 26 Mar 2019, at 17:24, Dr. Pala <[e-mail]> wrote:
> 
> Hi SAAG,
> 
> I just wanted to provide some feedback based on the contents of some presentations I have seen in the security area. In particular, I noticed that some authors seem to confuse the definition of information objects (ASN.1) and their encoding (e.g., DER). I noticed that, sometimes, when ASN.1 was mentioned, what was really the topic of discussion was actually related to DER encoding.
> 
> Since I have seen this happening multiple times, I am starting to wonder if I am the one who is wrong. In particular, my question is: do people in the security area support the statement that ASN.1 is equivalent to DER encoding ?
> 
> I ask this because ASN.1 is "used for the definition of data types, values, and constraints on data types." independently from the how the data is actually encoded (BER, PER, XER, DER, etc.) - it just happens that in X.509 PKIs, we use DER as the preferred encoding (and PEM for 7-bit transport mode). Therefore when we talk about certificate parsing, for example, we do parse DER/PEM, not ASN.1. For example, for the proposal around CBOR-encoded certificates (not endorsing the idea, just using this as an example), defining the CBOR Encoding Rules (CER ?) would provide a path to provide CBOR encoding for all ASN.1 definitions we use in PKIX.
> 
> Maybe this distinction is not important for people that already have a good understanding of the information model, however there might be newcomers (new IETF-ers or just new to the security area) that might think the two are the same when they are not, in my opinion.
> 
> Therefore, my recommendation is to keep this distinction in mind when talking about encoding and parsing of, for example, certificates. I hope this helps.
> 

Hi, Max.

I have noticed this as well. The thing is, although there are several sets of encoding rules (like GSER <https://tools.ietf.org/html/rfc3641>), in practice all of our certificates (and CRLs, certificate requests, and any other structure defined in ASN.1) are encoded in DER or BER. So it has become common to refer to “things whose structure is defined with ASN.1” and “things whose encoding is DER” as the same sets. Because they are. So a lot of us are referring to DER encoding as ASN.1 even though this is a mistake.

Maybe if some other encoding rule (like a CBOR encoding rule) got some traction, people would be more motivated to use the terms correctly.

Yoav