John,
There is a further flaw in the scheme. Because the ESSSecurityLabel is a
SET, it will be sorted when DER is used.
This means that the set elements will appear in the following order in the DER
encoding:
When Printable String Used - v1
Classification - tag 0x02
PolicyId - tag 0x06
Privacy - tag 0x13
Categories - tag 0x30
When UTF8 String Used - v2
Classification - tag 0x02
PolicyId - tag 0x06
Categories - tag 0x30
Version - 0x80
Privacy - tag 0x81
As you can see from this a v1 application will decode the Classification,
PolicyId and Categories successfully. When the Version tag is hit, the v1 app
will error. This is becuase the v1 app will be expecting a 0x13 as the octets
in
the SET encoding have not yet been exhausted. At best the app will log an
error,
at worst all hell breaks out.
The only way around this would be to use a tag that would force the Version
field
to appear first in the encoding. Unfortunately that would have to be 0x01
(BOOLEAN's tag) - yuk.
The definition (though I don't like it) would be
ESSSecurityLabel ::= SET {
version [UNIVERSAL 1] IMPLICIT Version DEFAULT v1,
security-policy-identifier SecurityPolicyIdentifier OPTIONAL,
security-classification SecurityClassification OPTIONAL,
privacy-mark ESSPrivacyMark OPTIONAL,
security-categories SecurityCategories OPTIONAL }
Personally, I would prefer to see this:
ESSSecurityLabel ::= CHOICE {
x411Label SecurityLabel,
enhancedLabel EnhancedLabel }
EnhancedLabel ::= SEQUENCE {
version Version DEFAULT v2,
essLabel ESSLabel }
ESSLabel ::= SET {
security-policy-identifier SecurityPolicyIdentifier OPTIONAL,
security-classification SecurityClassification OPTIONAL,
privacy-mark [1] IMPLICIT OCTET STRING SIZE(1..MAX)OPTIONAL,
security-categories SecurityCategories OPTIONAL }
What do you think?
Darren Harter
CASM Programme Office
CESG
John Pawling <jsp(_at_)jgvandyke(_dot_)com> 03/26 7:58 pm >>>
All,
We need to add a context-specific tag to the ESSSecurityLabel version field
because there are two INTEGERs in the SET. In order to keep the tags in
numerical order, recommend that ESSPrivacyMark utf8String should be changed
to "[1]" and then "[0]" can be used for ESSSecurityLabel version. This
results in the following:
ESSSecurityLabel ::= SET {
version [0] Version DEFAULT v1,
security-policy-identifier SecurityPolicyIdentifier OPTIONAL,
security-classification SecurityClassification OPTIONAL,
privacy-mark ESSPrivacyMark OPTIONAL,
security-categories SecurityCategories OPTIONAL }
ESSPrivacyMark ::= CHOICE {
pString PrintableString (SIZE
(1..ub-privacy-mark-length)),
-- If pString is used, the ESSSecurityLabel version is set to v1
utf8String [1] IMPLICIT OCTET STRING SIZE (1..MAX)
-- If utf8String is used, its contents MUST be in UTF8 format, and
-- the ESSSecurityLabel version is set to v2
}
================================
John Pawling, jsp(_at_)jgvandyke(_dot_)com
J.G. Van Dyke & Associates, Inc.
www.jgvandyke.com
================================