Subject: RE: [TLS] Record layer corner cases

From: Peter Williams <[email-masked]>
Date: Sat, 16 Dec 2006 20:04:16 -0800

in BER/DER encoding, the leading byte is required; the minimal # of 0s is required, for DER conformance. 0x001 is non conforming, therefore.
 
We discovered this an eon ago, along with NULL parms are serialized *explicitely* in DER-encoded ALGORITHM values
A tight, miliitary DER-decoder should reject non-conforming DER. General crap will probably be more liberal, on accepting stuff.

> Date: Wed, 13 Dec 2006 20:23:36 -0800> From: [email-masked]> To: [email-masked]> Subject: Re: [TLS] Record layer corner cases> CC: > > > o When using Diffie-Hellman key exchange, do you correctly strip> > leading zero bytes from the negotiated key (see Section 8.1.2)? > > If you don't, roughly once out of 256 connection attempts will fail.> > On a related note, my large integer code prepends a leading zero byte> if the most significant bit is a one to prevent it from appearing to> be negative. So when transferring the Diffie-Hellman p, g, Ys, and> Yc, they might have a leading zero byte. I haven't noticed any> problems with this, but wondered if this should be clarified to> either always do it, never do it, or leave it up to the implementer.> > Mike> > _______________________________________________> TLS mailing list> [email-masked]> https://www1.ietf.org/mailman/listinfo/tls
_________________________________________________________________
All-in-one security and maintenance for your PC.  Get a free 90-day trial!
http://www.windowsonecare.com/purchase/trial.aspx?sc_cid=wl_wlmail

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Sun, 17 Dec 2006 19:09:13 +0100

On Sat, Dec 16, 2006 at 08:04:16PM -0800, Peter Williams wrote:

>>> o  When using Diffie-Hellman key exchange, do you correctly strip
>>>    leading zero bytes from the negotiated key (see Section 8.1.2)? 
>>>    If you don't, roughly once out of 256 connection attempts will fail.

>> On a related note, my large integer code prepends a leading zero byte
>> if the most significant bit is a one to prevent it from appearing to
>> be negative.  So when transferring the Diffie-Hellman p, g, Ys, and
>> Yc, they might have a leading zero byte.  I haven't noticed any
>> problems with this, but wondered if this should be clarified to
>> either always do it, never do it, or leave it up to the implementer.

> in BER/DER encoding, the leading byte is required; the minimal # of
> 0s is required, for DER conformance. [...]

This isn't about BER/DER at all, though.  This is about integers
transmitted as "opaque"-type values in the TLS presentation language.
The specification so far only clearly describes fixed-length numeric
types (uint8, uint16, uint24, uint32, uint64), but in practice similar
rules are used for large numbers in those "opaque" fields (there is no
provision for signed values).