Subject: ASN.1 Clarification for Son of RFC2459

From: Dean Povey <[email-masked]>
Date: Tue, 04 Apr 2000 14:17:53 +1000

Hi all,

The new Certificate and CRL profile contains an appendix giving some 
implementation guidance with respect to ASN.1.  I would also like to add a 
paragraph here explaining the encoding of BIT STRING, particularly as it 
relates to the KeyUsage extension which is sometimes encoded incorrectly 
according to DER rules (I've made this mistake myself).  

The DER rules for BIT STRING (in addition to the BER rules) from X.690 are:

1. Must use primitive encoding.

2. Unused bits in the final octet string must be zero

However there is a third rule which is often forgotten (in particular it 
is not mentioned in the layman's guide published by RSA labs).

3. Where X.680 21.7 Applies (I'll get to that in a moment), the bitstring 
shall have all trailing zero bits removed before it is encoded.

x.680 21.7 refers to the use of a NamedBitList, in other words where the 
definition also gives some symbolic names to bits.  Note this then applies 
to KeyUsage extension, which is:

KeyUsage ::= BIT STRING {
        digitalSignature     (0),
        nonRepudiation       (1),
        keyEncipherment      (2),
        dataEncipherment     (3),
        keyAgreement         (4),
        keyCertSign          (5),
        cRLSign              (6),
        encipherOnly         (7),
        decipherOnly         (8) }

So in the case of KeyUsage if you do not set decipherOnly the bit string 
should be encoded in a single octet.

NB: I _think_ the following examples are correct :-)

e.g: digitalSignature | nonRepudiation

03 02 06 C0

e.g: decipherOnly

03 03 07 00 80

The first example is sometimes wrongly encoded:

03 02 07 C0 00

Which is correct for BER, but not for DER.

Is there any thoughts about whether it is sensible to add a statement 
about this to Son of RFC2459?

Also another comment, The End-Entity certificate example in Son of RFC 
2459 D.3 has the some of the SEQUENCEs BER encoded, which I don't believe is correct.

Cheers.

-- 
Dean Povey,         | e-m: [email-masked]     | JCSI: Java Crypto Toolkit 
Research Scientist  | ph:  +61 7 3864 5120       |  security.dstc.edu.au/ 
Security Unit, DSTC | fax: +61 7 3864 1282       | Oscar - C++ PKI Toolkit:
Brisbane, Australia | www: security.dstc.edu.au/ |  oscar.dstc.qut.edu.au/