[lamps] Re: [EXTERNAL] Re: WG Last Call for draft-ietf-lamps-csr-attestation-09

[Michael StJohns <[e-mail]>]

On 5/23/2024 4:33 PM, Russ Housley wrote:
> Mike:
>
> OtherCertificateFormat is exactly the same as TypedCert.  They produce 
> exactly the same bits on the wire.
>
> OtherCertificateFormat is exactly the same as TypedFlatCert when the 
> ASN.1 type associated with the OID is OCTET STRING.  Again, they 
> produce exactly the same bits on the wire.
>
> So, you are arguing in a embedded environment, the tag ([0] when the 
> format needs ASN.1 parsing, and [1] when it only has an OCTET STRING 
> wrapper) is valuable.  I have not done code for smart cards in over 20 
> years, but it seems that the look up of the OID is needed in either case.
>
> Russ


Hmm... not quite.   A [0] tag indicates that what comes after is 
structured ASN1 and it would be an error if the constructed bit in the 
TYPE field was not set.   Whereas a [1] tag indicates that the only 
acceptable type (irrespective of the OID) is an OCTET STRING 
containing/wrapping something that isn't guaranteed to be ASN1. That 
gives me two unique fail-fast points in the parsing, without having to 
do a OID parse and lookup.

But do with it what you will.  As I pointed out, we had similar 
discussions on this 18 months ago and I thought it was settled.

Later, Mike