Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Match OpenSSL output for enveloped data #268

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

roysjosh
Copy link

Do not include IMPLICIT ASN.1 elements in the output

Do not include IMPLICIT ASN.1 elements in the output
@roysjosh roysjosh force-pushed the MatchOpensslOutputForEnvelopedData branch from 3cf8080 to 0ba56f3 Compare June 13, 2018 22:03
@roysjosh
Copy link
Author

Ping. Do you need any more info?

@davidlehn
Copy link
Member

Sorry for the delay! I'm guessing no one has taken the time to figure out if this change is ok and won't break other code. Is there some spec text related to this? Are there tests that could be written?

@roysjosh
Copy link
Author

https://tools.ietf.org/html/rfc2315#section-10.1

ASN.1 IMPLICIT tags don't include the tag of the child element. See http://luca.ntop.org/Teaching/Appunti/asn1.html or google asn.1 implicit tagged object.

This is another good example:
https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.690-200811-S!!PDF-E&type=items

Also compare to OpenSSL's smime output.

Tests could probably be written. I can add a few if that would help. There's a comment in lib/pkcs7asn1.js about the output differing and accepting both types so I didn't mess with the capturing bits at all. I think you should continue to be lenient on parsing but switch to the more correct output since there does seem to be some interpretation differences.

@roysjosh
Copy link
Author

I should mention that the motivation for this change is that the JSS library used by Red Hat's Dogtag certificate server only accepts the encoding lacking the implicit element's child tag.

@roysjosh roysjosh closed this Aug 21, 2019
@roysjosh roysjosh deleted the MatchOpensslOutputForEnvelopedData branch August 21, 2019 12:42
@roysjosh roysjosh restored the MatchOpensslOutputForEnvelopedData branch August 21, 2019 12:45
@roysjosh roysjosh reopened this Aug 21, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants