Re: [saag] ASN.1 vs. DER Encoding

[Benjamin Kaduk <[e-mail]>]

Hi Max,

On Tue, Mar 26, 2019 at 05:24:38PM +0100, Dr. Pala wrote:
> Hi SAAG,
> 
> I just wanted to provide some feedback based on the contents of some 
> presentations I have seen in the security area. In particular, I noticed 
> that some authors seem to confuse the definition of information objects 
> (ASN.1) and their encoding (e.g., DER). I noticed that, sometimes, when 
> ASN.1 was mentioned, what was really the topic of discussion was 
> actually related to DER encoding.

Thanks for raising the topic.

> Since I have seen this happening multiple times, I am starting to wonder 
> if I am the one who is wrong. In particular, my question is: do people 
> in the security area support the statement that ASN.1 is equivalent to 
> DER encoding ?

I don't, though the comment downthread that in modern practice they appear
together is also t rue.

> I ask this because ASN.1 is "used for the definition of data types, 
> values, and constraints on data types." independently from the how the 
> data is actually encoded (BER, PER, XER, DER, etc.) - it just happens 
> that in X.509 PKIs, we use DER as the preferred encoding (and PEM for 
> 7-bit transport mode). Therefore when we talk about certificate parsing, 
> for example, we do parse DER/PEM, not ASN.1. For example, for the 
> proposal around CBOR-encoded certificates (not endorsing the idea, just 
> using this as an example), defining the CBOR Encoding Rules (CER ?) 
> would provide a path to provide CBOR encoding for all ASN.1 definitions 
> we use in PKIX.
> 
> Maybe this distinction is not important for people that already have a 
> good understanding of the information model, however there might be 
> newcomers (new IETF-ers or just new to the security area) that might 
> think the two are the same when they are not, in my opinion.
> 
> Therefore, my recommendation is to keep this distinction in mind when 
> talking about encoding and parsing of, for example, certificates. I hope 
> this helps.

Well, we should generally aim for precision in language, to the extent
reasonable.  Even occasionally being precise in this particular matter is
probably enough to keep us honest, whether we use sloppy shorthand the rest
of the time or not.

-Ben