Re: [TLS] TLS grammar checker?

[Nico Williams <[e-mail]>]

On Tue, Jun 18, 2013 at 5:20 PM, Bill Frantz <[e-mail]> wrote:
> On 6/18/13 at 10:36 AM, [e-mail] (Nico Williams) wrote:
>
>> This would make it possible to use ASN.1 for
>> specifying JSON schemas too, but no one who doesn't already have to
>> use ASN.1 wants to use ASN.1, though I myself like ASN.1 -- I only
>> hate its TLV encodings.
>
>
> Given the history of serious security problems due to ASN.1 parser bugs, I
> would feel better with a simpler format. (And yes, I'm one of the people who
> developed an allergy to ASN.1 through use.)

This tells me that you don't understand what you're talking about,
that your reaction is knee-jerk.

ASN.1 is just a syntax.  The security bugs have been in decoders of
some encoding rules of ASN.1, like BER.

And there have been security vulnerabilities in *many* encodings not
related to ASN.1, such as XDR, NDR, and others.  The problem is not
exclusive to TLV (tag-length-value) encoding rules of ASN.1 (like BER)
nor to ASN.1 encoding rules.  It's generic.

The syntax itself is fine as far as security goes.  It's not terribly
easy to parse (so that's one reason not to use it), that's about the
only significant problem with the *syntax*.

I'd go further and recommend the use of a syntax and encoding rules
for which there is suitable tooling available as this allows for more
formality in specifications, and fixing of bugs by fixing
encoder/decoder libraries, increasing code reuse, ...

Nico
--