Subject: Hash values in OCSP

From: [email-masked] (Miguel Angel Rodriguez)
Date: Wed, 16 Jan 2002 17:46:49 -0600

I request your help in the following issues regarding RFC 2560:

1. The IssuerNameHash has to be calculated using the DER encoding of the
issuer's name field EXACTLY as it appears in the target certificate (the one
being checked with OCSP)? Or is there a standard regarding the order of the
SETs in the RDN components?

2. The IssuerKeyHash value must be calculated excluding tag and length of
the DER encoding
of the subject public key field in the issuer's certificate. Since it is
encoded as a BIT STRING, are we required to include the first contents octet
(AKA the number of unused bits) in the input to the hash function?

Thanks, best regards,

Miguel A. Rodriguez
Software Engineer
SeguriDATA
Mexico

---

From: Rich Salz <[email-masked]>
Date: Wed, 16 Jan 2002 21:04:41 -0500

> SETs in the RDN components?

Well it's DER, which specifies exactly one way to encode things, so if
the cert is encoded in DER, then it is presumably encoding the RDN SETs
the right way.  So the answer to your question is "yes" :)

#2 -- someone else will have to answer; I've been away from OCSP for too
long.
	/r$

-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com