Subject: ASN1 question

From: [email-masked] (Pavel Krylov)
Date: Wed, 21 Oct 1998 11:40:22 +0400 (MSK DST)

Hi All!

I have a question about INTEGER encoding in <draft-ietf-pkix-ipki-part1-10.txt>.
If You saw in <D.3 End-Entity Certificate Using RSA> section of this draft,
You saw RSAPublicKey encoded as BIT STRING. Please, see in inner structure
of RSAPublicKey. By specification it is:

	RSAPublicKey ::= SEQUENCE {
         modulus            INTEGER, -- n
         publicExponent     INTEGER  -- e -- }

In draft it looked so:

0319 03 6b        107: . . . BIT STRING
                     : 00   (0 unused bits)
                     : 30 68 02 61 00 be aa 8b 77 54 a3 af ca 77 9f 2f
                     : b0 cf 43 88 ff a6 6d 79 55 5b 61 8c 68 ec 48 1e
                     : 8a 86 38 a4 fe 19 b8 62 17 1d 9d 0f 47 2c ff 63
                     : 8f 29 91 04 d1 52 bc 7f 67 b6 b2 8f 74 55 c1 33
                     : 21 6c 8f ab 01 95 24 c8 b2 73 93 9d 22 61 50 a9
                     : 35 fb 9d 57 50 32 ef 56 52 50 93 ab b1 88 94 78
                     : 56 15 c6 1c 8b 02 03 01 00 01

Question: Why is there 0 ( zero ) in first INTEGER ( -- n )? By ASN1 if
encoded integer value consists of more then one octet string, than first
octet shall not be 0xff or 0x00.

___________________________________________________
Krylov Pavel		[email-masked]

---

From: David Boyce <[email-masked]>
Date: Wed, 21 Oct 1998 10:10:47 +0100

Pavel Krylov writes:
>I have a question about INTEGER encoding in <draft-ietf-pkix-ipki-part1
-10.txt
>>.

                                    ^^ this zero

>octet shall not be 0xff or 0x00.

Pavel,

That zero is there to ensure that the INTEGER n is treated as a positive
number;  note that the top bit of the next octet ('be') is set.  If this
'00' were not present, the value would be regarded as negative.

You have not quoted the encoding rules correctly; it's the first NINE
bits (first OCTET and bit 8 of the next OCTET) which must not be
all 0 or 1.  The above encoding conforms to this.

David.

-- 
David Boyce

Tel:	+44 181 332 9091		Richmond, Surrey, ENGLAND
Email:	[email-masked]	Isode's WWW: http://www.isode.com/