Subject: maybe problem in RFC2459 with keyIdentifier

From: "Martin Szotkowski" <[email-masked]>
Date: Tue, 30 Oct 2001 16:27:31 +0100

Hi all,
I looked into RFC 2459 and last draft-ietf-pkix-new-part1-11 in both is same
mistake. (I think. Because my knowledge ASN.1 and BER is no so good)

Problem is in encode KeyIdentifier from ASN.1 to BER. KeyIdentifier is
defined as a OCTED STRING this should be 04 length data.
In SubjestKeyIdentifier is it OK:
80 20 SHA1_data
, but in AuthorityKeyIdentifier is not 04 encapsulated 80  (content
specific), but only 80.
wrong is: 80 20  SHA1_data
I think right should be: 80 22 04 20 SHA1_data

extract from last draft:
SubjectKeyIdentifier ::= KeyIdentifier

AuthorityKeyIdentifier ::= SEQUENCE {
      keyIdentifier             [0] KeyIdentifier           OPTIONAL,
      authorityCertIssuer       [1] GeneralNames            OPTIONAL,
      authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL  }

KeyIdentifier ::= OCTET STRING

example C.1 (correct):
 595 30   29:         SEQUENCE {
 597 06    3:           OBJECT IDENTIFIER
            :             subjectKeyIdentifier (2 5 29 14)
 602 04   22:           OCTET STRING, encapsulates {
 604 04   20:               OCTET STRING
            :                 86 CA A5 22 81 62 EF AD 0A 89 BC AD 72 41
            :                 2C 29 49 F4 86 56
            :               }
            :           }

example C.2 (incorrect):
 640 30   31:         SEQUENCE {
 642 06    3:           OBJECT IDENTIFIER
            :             authorityKeyIdentifier (2 5 29 35)
 647 04   24:           OCTET STRING, encapsulates {
 649 30   22:               SEQUENCE {
 651 80   20:                 [0]
            :                   86 CA A5 22 81 62 EF AD 0A 89 BC AD 72
            :                   41 2C 29 49 F4 86 56
            :                 }
            :               }
            :           }
            :         }

regards,
Martin