Subject: Re: New test TSA available

From: Bernd Matthes <[email-masked]>
Date: Tue, 02 Oct 2001 19:21:34 +0200

Peter Gutmann wrote:
> 
> There's a new TSA available at tsa.cryptoapps.com:3318, running in a FIPS 140-1
> level 4 device (it's just a demo which runs single-threaded, so if you throw
> a huge number of concurrent requests at it you may get some refused
> connections, although I doubt it'll be a big issue for now).  There will also
> be an OCSP responder at ocsp.cryptoapps.com and a CMP server at
> cmp.cryptoapps.com in the near future running on the same hardware, at the
> moment I think the ports are still blocked so you won't be able to get to them.
> 
> Peter.

Hi Peter!

I tried Your TSA.
I could connect and got a response.
In parsing the response I got an ASN.1 error.
Here is Yours: 
   0 30 1706: SEQUENCE {
   4 30    3: . SEQUENCE {
   6 02    1: . . INTEGER 0
            : . . }
   9 30 1697: . SEQUENCE {
  13 06    9: . . OBJECT IDENTIFIER pkcs7signedData (1 2 840 113549 1 7
2)
  24 A0 1682: . . [CONTEXT-SPECIFIC 0] {
  28 30 1678: . . . SEQUENCE {
  32 02    1: . . . . INTEGER 1
  35 31   11: . . . . SET {
  37 30    9: . . . . . SEQUENCE {
  39 06    5: . . . . . . OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
  46 05    0: . . . . . . NULL
            : . . . . . . }
            : . . . . . }
  48 30  121: . . . . SEQUENCE {
  50 06   11: . . . . . OBJECT IDENTIFIER
            : . . . . . . id-smime-ct-TSTInfo (1 2 840 113549 1 9 16 1
4)
  63 A0  106: . . . . . [CONTEXT-SPECIFIC 0] {
  65 30  104: . . . . . . SEQUENCE {
      ^---- My question: Should this tag be an OCTET STRING like in the
dump below?

  67 30  102: . . . . . . . SEQUENCE {
  69 02    1: . . . . . . . . INTEGER 1
  72 06   10: . . . . . . . . OBJECT IDENTIFIER '1 3 6 1 4 1 3029 56 36
54'

and now a other:
   0 30 1583: SEQUENCE {
   4 30    3: . SEQUENCE {
   6 02    1: . . INTEGER 0
            : . . }
   9 30 1574: . SEQUENCE {
  13 06    9: . . OBJECT IDENTIFIER pkcs7signedData (1 2 840 113549 1 7
2)
  24 A0 1559: . . [CONTEXT-SPECIFIC 0] {
  28 30 1555: . . . SEQUENCE {
  32 02    1: . . . . INTEGER 1
  35 31   11: . . . . SET {
  37 30    9: . . . . . SEQUENCE {
  39 06    5: . . . . . . OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
  46 05    0: . . . . . . NULL
            : . . . . . . }
            : . . . . . }
  48 30  312: . . . . SEQUENCE {
  52 06   11: . . . . . OBJECT IDENTIFIER
            : . . . . . . id-smime-ct-TSTInfo (1 2 840 113549 1 9 16 1
4)
  65 A0  295: . . . . . [CONTEXT-SPECIFIC 0] {
  69 04  291: . . . . . . OCTET STRING, encapsulates {
  73 30  287: . . . . . . . . SEQUENCE {
  77 02    1: . . . . . . . . . INTEGER 1

with kind regards

-- 
Bernd Matthes               Celo Communications GmbH
Senior Software Engineer          - a Gemplus Company
Dipl.-Ing.(FH)              mailto:[email-masked]
------------------------------------------------------------
"Complexity breeds bugs. Bugs prevent adoption,
lack of adoption results in death. Death not good."

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 10 Oct 2001 03:40:18 +1300 (NZDT)

Bernd Matthes <[email-masked]> writes:

>But the next question: You send the root of the TSA cert in certificates
>field. My verify function complains that a self sign cert is in cert chain.
>Should I tolerate this or is the complaint ok? I'm not sure.

Given the open-ended interpretation of what you can put in there, I'm sure it
could be argued that stuffing PGP certs in there is valid.  For my part, I just
put the whole chain in and let the relying party pepper and salt it as they
please.

Peter.