Re: [TLS] Verifying X.509 Certificate Chains out of order

Peter Sylvester <Peter.Sylvester@edelweb.fr> Tue, 07 October 2008 15:59 UTC

Return-Path: <tls-bounces@ietf.org>
X-Original-To: tls-archive@ietf.org
Delivered-To: ietfarch-tls-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CFDCE3A699C; Tue, 7 Oct 2008 08:59:59 -0700 (PDT)
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B1603A69AD for <tls@core3.amsl.com>; Tue, 7 Oct 2008 08:59:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.238
X-Spam-Level:
X-Spam-Status: No, score=0.238 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_BAD_ID=2.837]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 57tCGi3ARqGj for <tls@core3.amsl.com>; Tue, 7 Oct 2008 08:59:53 -0700 (PDT)
Received: from ganymede.on-x.com (ganymede.on-x.com [194.51.68.3]) by core3.amsl.com (Postfix) with ESMTP id A5A363A699C for <tls@ietf.org>; Tue, 7 Oct 2008 08:59:51 -0700 (PDT)
Received: from vinea.on-x.com (sedna.puteaux.on-x [192.168.10.9]) by ganymede.on-x.com (Postfix) with ESMTP id 99B0357; Tue, 7 Oct 2008 18:00:28 +0200 (CEST)
Received: from [193.51.14.5] ([212.234.46.65]) by vinea.on-x.com (Lotus Domino Release 5.0.11) with ESMTP id 2008100718002737:159695 ; Tue, 7 Oct 2008 18:00:27 +0200
Message-ID: <48EB8642.4020509@edelweb.fr>
Date: Tue, 07 Oct 2008 17:54:42 +0200
From: Peter Sylvester <Peter.Sylvester@edelweb.fr>
User-Agent: Thunderbird 1.5.0.9 (X11/20061206)
MIME-Version: 1.0
To: Eric Rescorla <ekr@networkresonance.com>
References: <E1KnDKN-0005hN-Q8@wintermute01.cs.auckland.ac.nz> <48EB745B.9050403@edelweb.fr> <20081007151008.DCA7750846@romeo.rtfm.com>
In-Reply-To: <20081007151008.DCA7750846@romeo.rtfm.com>
X-MIMETrack: Itemize by SMTP Server on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 10/07/2008 06:00:27 PM, Serialize by Router on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 10/07/2008 06:00:28 PM, Serialize complete at 10/07/2008 06:00:28 PM
Cc: tls@ietf.org
Subject: Re: [TLS] Verifying X.509 Certificate Chains out of order
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0004670621=="
Sender: tls-bounces@ietf.org
Errors-To: tls-bounces@ietf.org

>
> I don't think I understand the question: this isn't any kind of 
> ASN.1 structure. It's a TLS vector DER-encoded certs. 
> I.e.
>   
ouups; right.

Is ASN.1Cert defined in the text.
It does not says that you have a DER encoded cert.
It could be BER, CER, DER, at least partially. But
not XER and not PEM.

Anyway, no big deal.
> 24-bit length field = Y
>    24-bit length field = X  \ cert 1
>    encoded cert (length X)  /
>    24-bit length field = W  \ cert 2
>    encoded cert (length W)  /
>
> -Ekr
>
>
>   


-- 

<http://www.edelweb.fr>
*Edel/W/eb* 	Peter SYLVESTER
Consultant Sécurité des Systèmes d'Information
-----------------------------------------------------------
EdelWeb - Groupe ON-X
15, quai de Dion-Bouton
F-92816 Puteaux Cedex
Tel : +33.1.40.99.14.14 / Fax : +33.1.40.99.99.58
www.edelweb.fr <http://www.edelweb.fr> / www.on-x.com <http://www.on-x.com>
-----------------------------------------------------------
To verify the message signature, see edelpki.edelweb.fr 
<http://edelpki.edelweb.fr/>
Cela vous permet de charger le certificat de l'autorité de racine 
<http://edelpki.edelweb.fr/cacerts/EdelPKI-ca.der>;;
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls