[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: going back to stone axes




> From: frantz@netcom.com (Bill Frantz)
>
>  /* BTSOOM what CONSTRUCTED means */

nice acronym - I'll have to remember that one :-)


/* IDENTIFIER OCTET = Tag Class | Form of Encoding | Tag Number */

/* TAG CLASSES */
#define CLASS_MASK      0xc0    /* bits 8 and 7 */
#define UNIVERSAL       0x00    /* 0 = Universal (defined by ITU X.680) */
#define APPLICATION     0x40    /* 1 = Application */
#define CONTEXT         0x80    /* 2 = Context-specific */
#define PRIVATE         0xc0    /* 3 = Private */

/* FORM OF ENCODING */
#define FORM_MASK       0x20    /* bit 6 */
#define PRIMITIVE       0x00    /* 0 = primitive */
#define CONSTRUCTED     0x20    /* 1 = constructed */


>
> This code assumes that either: (1) All the data will be in memory, so the
> system which uses it should have a packet buffer whose length is greater
> than 0x7fffffff, or (2) The calling code will be willing to continue to
> fill a shorter buffer from the network while it is parsing *data.

... and Carl notes that the code exit()'s if length is greater than
2^32.

That is exactly the point.  We are discussing using ASN.1 for certificate
handling, not MPEG video streams.  Just because ASN.1 allows a designer
to specify indefinite length structures, and BER allows them to be
transmitted, does not mean that ASN.1 software *for certificate purposes*
must be fully general, large, or baroque.

I submit that it is perfectly reasonable for an implementation to
barf (call an error routine, not exit!) if it receives something that
should be a certificate but has a length > 2^16 or 2^32.  The implementation
I'm familiar with uses 2048 byte slots to store certificates, more than
half of which is generally unused.  This is plenty small enough to allow
in-memory processing on any reasonable machine.

A previous poster questioned whether a "tiny subset" of ASN.1 would be
useful for anything.  Certainly it is - using only UNIVERSAL tags
and limiting lengths to something reasonable gets rid of 99.7% of the
code complexity without compromising the ability to do anything
desirable (short of MPEG logos :-) with ASN.1 format certificates.