🚀 go-pugleaf

khiem@hpindda.cup.hp.com (Khiem Ho) writes:

|>The new encoding rules of ASN.1 ...
|...etc...
|>
|>ISO 8825-3 | X.209-3 describe the Canonical and Distinguished Encoding
|>Rules of ASN.1 (CER & DER).  These are derived from BER and are used in
|>encoding a message so that there is only one encoded value for a given
|>message.  For example, in BER a BOOLEAN is encoded as 0 if the value is
|>FALSE, and non-zero if it is TRUE.  CER & DER on the other hand, state
|>that if the value is TRUE, it must be encoded as a 1 (hence the name canonical
|>and distinguished).  So, with CER & DER there is a 1-1 mapping between
|>the ASN.1-described types and the encoded values, whereas BER gives
|>more flexibility.  So why two encoding rules to do 1-1 mappings?  DER caters
|>to applications that have a need for a single way to encode data using
|>definite length encoding, while CER caters to applications that have a need
|>for a single way to encode data using indefinite length encoding.
|>
|>DER and CER are both Draft International Standards.  PER is a Committee Draft
|>that may progress to DIS status in the October/November timeframe.
|...etc...

|There's canonical BER defined in X.509 for security. Does anyone has
|any info about this C-BER comparing to the CER/DER above, and if
|there's any implementation supporting C-BER for X.509-security
|applications?

The Distinguished Encoding Rules (DER) defined in the ISO 8825-3 | 
CCITT X.209-3 draft international standard is the same as that described 
in X.509, except:

1. DER has a clause that specifies how trailing zero bits are to be treated
   when the BIT STRING is defined using a NamedBitList, and when it isn't.

2. DER specifies that: "The encoding of values of the GeneralString type 
   (and its subtypes) shall generate escape sequences to designate and 
   invoke a new register entry only when the register entry for the character
   is different from that currently designated as G0, C0, or C1.  All 
   designations and invocations shall be into the G0 set or the C0 set".

   More work is required to cover shift and locking shift characters, etc.

3. DER specifies a canonical form for encoding GeneralizedTime.

As you can see, these three points close holes that are present in X.509's
canonical BER, so DER satisfies the canonical BER specified in X.509.

As far as DER implementations supporting X.509-security is concerned, anyone
interested in this should email me directly for information on commercial
products.

=====================================|========================================
Bancroft Scott			     |		Open Systems Solutions, Inc.
609-987-9073			     |		Princeton, N.J.
=====================================|========================================