Subject: Bug in VeriSign's PKIX Logotype Implementation?

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 1 Oct 2006 12:24:43 +0200

Dear list;

Source of certificate: https://www.verisign.com

It seems that there may be a bug in VeriSign's logotype implementation.
Although there is a virtual orgie in SEQUENCEs here, there should possibly be yet one more.

Anders Rundgren

DumpASN1 extract:

037F 30   6D:         SEQUENCE {
0381 06    8:           OBJECT IDENTIFIER '1 3 6 1 5 5 7 1 12'
038B 04   61:           OCTET STRING, encapsulates {
038D 30   5F:               SEQUENCE {
038F A1   5D:                 [1] {
0391 A0   5B:                   [0] {
0393 30   59:                     SEQUENCE {
0395 30   57:                       SEQUENCE {
0397 30   55:                         SEQUENCE {
0399 16    9:                           IA5String 'image/gif'
03A4 30   21:                           SEQUENCE {
03A6 30   1F:                             SEQUENCE {
03A8 30    7:                               SEQUENCE {
03AA 06    5:                                 OBJECT IDENTIFIER
            :                                   sha1 (1 3 14 3 2 26)
            :                                 }
03B1 04   14:                               OCTET STRING
            :                   8F E5 D3 1A 86 AC 8D 8E 6B C3 CF 80 6A D4 48 18
            :                   2C 7B 19 2E
            :                               }
            :                             }
03C7 30   25:                           SEQUENCE {
03C9 16   23:                             IA5String 'http://logo.verisign.com/vslogo.gif'
            :                             }

Extract of RFC 3709:

LogotypeExtn ::= SEQUENCE {
   communityLogos  [0] EXPLICIT SEQUENCE OF LogotypeInfo OPTIONAL,
   issuerLogo      [1] EXPLICIT LogotypeInfo OPTIONAL,
   subjectLogo     [2] EXPLICIT LogotypeInfo OPTIONAL,
   otherLogos      [3] EXPLICIT SEQUENCE OF OtherLogotypeInfo OPTIONAL }

LogotypeInfo ::= CHOICE {
   direct          [0] LogotypeData,
   indirect        [1] LogotypeReference }

LogotypeData ::= SEQUENCE {
   image           SEQUENCE OF LogotypeImage OPTIONAL,
   audio           [1] SEQUENCE OF LogotypeAudio OPTIONAL }

LogotypeImage ::= SEQUENCE {
   imageDetails    LogotypeDetails,
   imageInfo       LogotypeImageInfo OPTIONAL }

LogotypeDetails ::= SEQUENCE {
   mediaType       IA5String, -- MIME media type name and optional
                              -- parameters
   logotypeHash    SEQUENCE SIZE (1..MAX) OF HashAlgAndValue,
   logotypeURI     SEQUENCE SIZE (1..MAX) OF IA5String }

HashAlgAndValue ::= SEQUENCE {
   hashAlg         AlgorithmIdentifier,
   hashValue       OCTET STRING }

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 1 Oct 2006 20:49:08 +0200

Error,

A friendly person off-list showed me that the DEFAULT IMPLICIT 
directive is the reason why there are only 3 sequeces in a row.

thanx
Anders

----- Original Message ----- 
From: Anders Rundgren 
To: [email-masked] 
Sent: Sunday, October 01, 2006 12:24
Subject: Bug in VeriSign's PKIX Logotype Implementation?

Dear list;

Anders Rundgren

DumpASN1 extract:

037F 30   6D:         SEQUENCE {

Extract of RFC 3709: