Subject: Trying to relate PKCS & IETF standards to encoding rules

From: Goulet Walter-CWG009 <[email-masked]>
Date: Tue, 24 May 2005 09:57:13 -0500

Hi,

I'm trying to grasp how certificates and associated artifacts of PKI
(private keys, CRLs, CSRs etc) are encoded and how the standards are
related to eachother.

My understanding of the relationships is:

Standards for x.509 (spec. in RFC3280 and ITU-T x.509) as well as the
various PKCS standards developed primarily by RSA labs are specified
as ASN.1.

ASN.1 cannot be directly encoded since it consists of abstract types,
so the standards specify DER (which is a more restrictive BER
encoding; basically it's a binary representation of ASN.1 values).

PEM (defined in RFC 1421 - 1424, but what I care about is in 1421)
defines a way to encode binary cryptographically sensitive data so it
can be transported in text over SMTP.

However, I haven't seen standards, notably for x.509 itself, that
describe how to encode data from DER -> PEM.

I suspect there must be a standard since for x.509 files there is a
standard 'BEGIN CERTIFICATE/END CERTIFICATE' header and footer for
certificates (and similarly, private keys and CSRs).

Is there a set of RFCs that describes these standards? Maybe there is
a standard describing in general how to encode from DER -> PEM and
describes how the headers/footers are built.

Any help would be appreciated.

Thanks,
-
Walter Goulet
[email-masked] Nextel: (847)366-9519 Pvt. ID 9519
Desk: (847)576-7036

---

From: Stephen Kent <[email-masked]>
Date: Tue, 24 May 2005 11:35:27 -0400

Walter,

The ITU-T X.509 and the IETF PKIX specs call for binary encoding of 
the ASN.1 for certs and CRLs, specifically DER, as you noted.

PEM, which is now historical, also called for binary encoding  (DER) 
of the ASN.1, and then specified the base64 encoding of the binary 
representation for "safe" carriage over SMTP.

So the two sets of specs were not in conflict. It's just that PEM 
specified an additional layer of encoding for content transfer 
purposes, which is what MIME does as well, when necessary.

DER to base64 is an easy encoding, because base64 takes any binary 
sytring and says how to encode it as text.

Steve

---

From: Sam Roberts <[email-masked]>
Date: Tue, 24 May 2005 12:13:10 -0400

> describes how the headers/footers are built.

Not that I'm aware of, the names to use in the PEM headers are
"customary", you have to see whats out there (and there is a fair amount
of variation), and do what others do.

Maybe an informational I-D would be useful to help bring some
consistency to the practice.

Cheers,
Sam

-- 
http://www.certicom.com

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 25 May 2005 05:03:15 +1200

Sam Roberts <[email-masked]> writes:

>Maybe an informational I-D would be useful to help bring some consistency to
>the practice.

Given the deployed base, I doubt it'd make much difference to existing
implementations.  What you could do though is document current practice to
help others who're coming along and want to implement something that
interoperates.

Peter.