Subject: x509 and ASN1 version 2002

From: Peter Sylvester <[email-masked]>
Date: Mon, 10 Jun 2002 17:16:56 +0200 (MET DST)

Hello,

I would like to know what people would think about a replacement
of the definition of Extension by using a 2002 mechanism in
ASN1 as something like:

Extension         ::=   SEQUENCE {
    extnId            EXTENSION.&id ({ExtensionSet}),
    critical          BOOLEAN DEFAULT FALSE,
    extnValue         OCTET STRING (
         CONTAINING EXTENSION.&ExtnType({ExtensionSet}{@extnId})
    }

Note that I there is no

ENCODED BY {joint-iso-itu-t asn1(1) ber-derived(2) distinguished-encoding(1)})

because I think it is may not necessary. It is not for signature calculation, 
but may create some backwards compatiblity problem for contexts where a certificat
is transfered in PER.

Is there someone aware of an application that transfers certificats
in any other encoding that DER? 

(I am not talking about certificates that are in BER and the signature
 is done over the BER blob.)

Regards

---

From: "Housley, Russ" <[email-masked]>
Date: Tue, 11 Jun 2002 13:38:36 -0400

>in any other encoding that DER?

Yes.  X.500 DAP often does so.  In many implementations, the DAP PDU (which 
is also defined in ASN.1) encodes the DAP header and the DAP payload in one 
blob.  Thus, certificates end up being re-encoded in BER, since BER is the 
transfer syntax normally used in DAP.

Russ