[EMAIL PROTECTED] wrote:
>
> Hello, I'm experiencing with some problems with the DER encoding of a BIT
> STRING.
> Indeed when you have to produce an BIT STRING with all the bit set to zero
> if you use the ASN1_BIT_STRING_set passing to it such a string what you
> obtain is that
> the final encoding of the bit string is 03 02 00 CD that it's wrong. If
> I have understood correctly the code the problem is in the i2c_ASN1_BIT_STRING
> because the last one cannot handle the case in which the length of the string
> is set to one but the string is empty.
>
The actual length value in a BIT STRING in the OpenSSL ASN1_BIT_STRING
field refers to the length excluding the initial octet: i.e. the number
of unused bits. The number of unused bits is handled and encoded using
the flags field.
> Taking into account that sometimes is necessary to have a bit string with
> all bit set to zero (e.g., the TSP protocol introduces:
> PKIFailureInfo ::= BIT STRING {
> badAlg (0),
> -- unrecognized or unsupported Algorithm Identifier
> ...) what is the correct behaviour:
>
> 1) just avoid to call the ASN1_BIT_STRING_set, in this case you obtain the
> encoding 03 01 00 (my concern is that, according to the specification, the
> first contect octet must be used to encode the number of "unused bits" so
> I'm not sure if this encoding is correct or not)
>
According to X.690 8.6.2.3:
"If the bitstring is empty, there shall be no subsequent octets, and the
initial octet shall be zero."
or yes thats OK.
> 2) is the alternative encoding 03 02 00 00 correct ? (i.e., do we have to
> be able to correctly handle it ? I found a way to produce also that one).
>
Its OK for an unnamed bit string (i.e. a wrapper for another structure
like a public key). For a named bit string its a valid BER but not DER.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
