Subject: example 5.2 basic signed content RSA

From: "Ronen" <[email-masked]>
Date: Wed, 4 Jun 2003 09:56:09 +0300

hi,
i am coding CMS ( RFC3380 ) and i was parsing example 5.2 at
draft-ietf-smime-examples-10.txt and got to the Certificate part.
i like to know why it is SEQUENCE ( in the example ) and not SET OF  (as
like in the CMS RFC3380 ).

This is how it is defined in the RFC :
SignedData ::= SEQUENCE {
        version CMSVersion,
        digestAlgorithms DigestAlgorithmIdentifiers,
        encapContentInfo EncapsulatedContentInfo,
        certificates [0] IMPLICIT CertificateSet OPTIONAL,
        crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
        signerInfos SignerInfos }

 CertificateSet ::= SET OF CertificateChoices

in draft-ietf-smime-examples-10.txt  ex5.2 Basic signed content it is :
-------------------- Content Info -----------------------
-
 0 30  850: SEQUENCE {

-------------------- Content Type -----------------------

   4 06    9:   OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
            :     (PKCS #7)

------ content [0] EXPLICIT ANY DEFINED BY contentType ---------

  15 A0  835:   [0] {

--------------------- SignedData -------------------------------
----
  19 30  831:     SEQUENCE {

--------------------  version ----------------------------------
  23 02    1:       INTEGER 1
-------------------- digestAlgorithems -------------------------
  26 31   11:       SET {
  28 30    9:         SEQUENCE {
  30 06    5:           OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
            :             (OIW)
  37 05    0:           NULL
            :           }
----------------------------------------------------------------
            :         }
-------------------------- encapsulated Content ----------------
  39 30   43:       SEQUENCE {
  41 06    9:         OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
            :           (PKCS #7)
  52 A0   30:         [0] {
  54 04   28:           OCTET STRING 'This is some sample content.'
            :           }
            :         }

-------------- The start of the Certificate -------------------

  84 A0  560:       [0] {
  88 30  556:         SEQUENCE {       <------ why not SET !!! ? ? ? ?
  92 30  405:           SEQUENCE {
  96 A0    3:             [0] {
  98 02    1:               INTEGER 2
            :               }
101 02   16:             INTEGER
            :               46 34 6B C7 80 00 56 BC 11 D3 6E 2E
            :               C4 10 B3 B0
119 30   13:             SEQUENCE {
121 06    9:               OBJECT IDENTIFIER
            :                 sha1withRSAEncryption
            :                     (1 2 840 113549 1 1 5)
            :                 (PKCS #1)
132 05    0:               NULL
            :               }
134 30   18:             SEQUENCE {
136 31   16:               SET {
138 30   14:                 SEQUENCE {
140 06    3:                   OBJECT IDENTIFIER

---

From: "Blake Ramsdell" <[email-masked]>
Date: Wed, 4 Jun 2003 02:01:27 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Ronen
> Sent: Tuesday, June 03, 2003 11:56 PM
> To: [email-masked]
> Subject: example 5.2 basic signed content RSA
> 

I believe you're out of sync.  Annotated, I believe this example
corresponds to the following:

>   84 A0  560:       [0] { -- CertificateSet
>   88 30  556:         SEQUENCE { -- Certificate
>   92 30  405:           SEQUENCE { -- TBSCertificate
>   96 A0    3:             [0] { -- Version
>   98 02    1:               INTEGER 2
>             :               }
> 101 02   16:             INTEGER

I think the SET for CertificateSet is implicit, and is replaced by the
[0] tag.  The SEQUENCE you point out belongs to the first Certificate in
the set.  I could be lying, however.

Blake