Subject: Re: SPNEGO-bis comments/questions

From: Tom Yu <[email-masked]>
Date: Mon, 03 Jan 2005 16:17:19 -0500

>>>>> "lzhu" == Liqiang\(Larry\) Zhu <Liqiang> writes:

lzhu> 1) The ContextFlags will be decorated with the size constrain.

lzhu> ContextFlags ::= BIT STRING (SIZE (32)) {
lzhu>         delegFlag       (0),
lzhu>         mutualFlag      (1),
lzhu>         replayFlag      (2),
lzhu>         sequenceFlag    (3),
lzhu>         anonFlag        (4),
lzhu>         confFlag        (5),
lzhu>         integFlag       (6)
lzhu> }

Please recall that applying a size constraint to BIT STRING with named
bits requires that a DER encoder truncate trailing zero bits.  This
caused interoperability problems for Kerberos.

---Tom

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Sam Hartman <[email-masked]>
Date: Mon, 03 Jan 2005 16:59:50 -0500

>>>>> "Tom" == Tom Yu <[email-masked]> writes:

    Tom> Please recall that applying a size constraint to BIT STRING
    Tom> with named bits requires that a DER encoder truncate trailing
    Tom> zero bits.  This caused interoperability problems for
    Tom> Kerberos.

doesn't DER already imply this?

--Sam

---

From: Tom Yu <[email-masked]>
Date: Mon, 03 Jan 2005 17:10:45 -0500

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

Sam> doesn't DER already imply this?

Oops, yeah, it already does require the truncation, but the size
constraint doesn't change the truncation.

---Tom

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 3 Jan 2005 16:28:40 -0600

> doesn't DER already imply this?

Yes, but it's a good warning/reminder to have.

---

From: Simon Spero <[email-masked]>
Date: Mon, 03 Jan 2005 17:30:20 -0500

>doesn't DER already imply this?
It's a little confusing, but in this case it's not too bad.

X.690 requires all  unused bits in the final octet to be set to zero

    11.2.1 Each unused bit in the final octet of the encoding of a bit
    string value shall be set to zero.
    ITU X.690 § 11.2.1

It also requires trailing zero's to be stripped before transmission iff 
the abstract type has a named bit list defined

    11.2.2 Where ITU-T Rec. X.680 | ISO/IEC 8824-1, 21.7, applies, the
    bitstring shall have all trailing 0 bits removed
    before it is encoded.. 
    X.690 §11.2.2

If  there are no bits set, then DER/CER generate an encoding with length 
1 and value 0.

    NOTE 2 - If a bitstring value has no 1 bits, then an encoder shall
    encode the value with a length of 1 and an initial octet set to 0.
    X.690 § 11.2.2 at Note 2

The effect of the size constraint is only visible to the decoding 
application;  the decoder is supposed to append trailing zero bits to 
the decoded value to make it fit the size constraint.

    NOTE 1 - In the case where a size constraint has been applied, the
    abstract value delivered by a decoder to the application will be
    one of those satisfying the size constraint and differing from the
    transmitted value only in the number of trailing 0 bits.
    X.690 § 11.2.2 at Note 1

Simon