Nilsson Hans <HNN(_at_)ausys(_dot_)se> 02/03 10:49 am >>>
snipped...
---------------------------------------------------------------
I have consulted different experts and of course received different
reponses:
Response A:
The Certificate Extensions module uses specifies IMPLICIT tags
('DEFINITIONS IMPLICIT TAGS ::= BEGIN ...). Hence, IMPLICIT tags must
be used for selecting the 'rfc822Name' (e-mail) choice in the
'subjectAltName' extension.
Correct.
Response B:
That is an example of where the "gotcha" rule on IMPLICIT tagging
applies :-)
X.680 section 28.6:
The tagging construction specifies explict tagging if any of the
following holds:
a) ..
b) ..
c) the "Tag Type" alternative is used an the value of TagDefault for
the module is "IMPLICIT TAGS" or "AUTOMATIC TAGS", but the type
defined by "Type" is a choice type, open type, or a
DummyReference.
so even in an IMPLICIT TAGS module, GeneralName (a CHOICE) is encoded
using explicit tagging, as shown in the PKIX-1 example.
GeneralName is not explicitly tagged unless it is used within another
structure and is optional in its usage (i.e. if it is OPTIONAL, a CHOICE
element, or a SET element).
e.g.
Test ::= SEQUENCE {
genName [0] IMPLICIT GeneralName OPTIONAL }
would be encoded EXPLICITLY as 30 06 A0 04 A4 02 30 00 ... if an "empty"
Name was chosen in the GeneralName. Note the Name is EXPLCITLY tagged also.
The important thing to note in this is that the EXPLCIT for CHOICE rule
is not recursive, so the rfc822Name in GeneralName is NOT explcitly
tagged.
But what does X.208 say?
Response C:
In the definition of GeneralName we have
rfc822Name [1] IA5String,
directoryName [4] Name,
And from X.680:
c) the "Tag Type" alternative is used an the value of TagDefault
for
the module is "IMPLICIT TAGS" or "AUTOMATIC TAGS", but the type
defined by "Type" is a choice type, open type, or a
DummyReference.
With rfc822name, the Type is IAString, which means that IMPLICIT should
be used
BUT for directoryName the Type is Name, which is a CHOICE, which means
that EXPLICIT should be used.
Correct, as I have just described.
------------------------------------------------------------------------
------------------------------------
Looking forward to your help!
Hans Nilsson
AU-System
Stockholm, Sweden
Hope this helps...
Darren Harter