Subject: Re: Matching CertIDs between OCSP requests and responses

From: [email-masked]
Date: Mon, 19 Mar 2001 17:40:52 +0000

Jeff,

Under BER there are several ways to encode a given value of certain data
types, but DER is a subset of this in which every detail of the encoding is
unambiguously specified (if you're strict about your DER, of course).  The
OCSP spec specifies DER, so in a bug-free world every byte should match.

Regards,

Jonathan
------------
Dr Jonathan Tuliani
www.symbian.com

                    Jeff Jacoby                                                                                       
                    <jjacoby@rsasec        To:     [email-masked]                                                  
                    urity.com>             cc:                                                                        
                                           Subject:     Re: Matching CertIDs between OCSP requests and responses      
                    19/03/01 17:28                                                                                    

Peter,

[email-masked] wrote:

[snip]

> Unless you check the returned ID data there's no way you can detect
> this.  What
> I'm doing is a binary compare of request and response ID data, if they
> differ I
> don't trust the response.

Pardon my naivte, but couldn't the responder apply a different BER/DER
encoding to CertID in its response, yet keeping the actual encoded
values
within a CertID identical?

Jeff

**********************************************************************
Symbian Ltd is a company registered in England and Wales with registered number 01796587 and registered office at 19 Harcourt Street, London, W1H 4HF, UK.
This message is intended only for use by the named addressee and may contain privileged and/or confidential information. If you are not the named addressee you should not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify [email-masked] and delete the message and any attachments accompanying it immediately. Symbian does not accept liability for any corruption, interception, amendment, tampering or viruses occuring to this message in transit or for any message sent by its employees which is not in compliance with Symbian corporate policy.
**********************************************************************

---

From: Jeff Jacoby <[email-masked]>
Date: Tue, 20 Mar 2001 08:17:10 -0800

Jonathan,

[some snippage]

Reading both 2560 and the draft for v2, I see this regarding DER
encoding:

 1. Before calculainting hashs and signatures DER is specified in 
    various sections

 2. In section 4.1.1 Request Syntax,  aside from items noted in 1.
above,
    there is no other mention of a DER encoding requirment for requests
or
    any part of the request

 3. In section 4.2.1 ASN.1 Specification of the OCSP Response, there is
    an explicit statement that DER shall be used for encoding of
BasicOCSPResonse

 4. Appendix A OCSP over HTTP, there are explicit statements that DER is
to
    be used (but no use of "SHALL" or "MUST") for both request and
responses

On point 3 alone -- and this may show off my ignorance of ASN.1 -- does
saying 
that BasicOCSPResponse must be DER encoded ALSO mean all subbordinate
components
must be DER encoded as well?

On points 2 and 4 together, it seems that if I use another transport
protocol
I'm allowed to encode my requests in BER.  Is this right?

Jeff