Peter Gutmann wrote:
"David P. Kemp" <dpkemp(_at_)missi(_dot_)ncsc(_dot_)mil> writes:
I've often wondered whether ASN.1 could be used to express the bits on the
wire of an existing protocol such as IPSEC's AH. To do so, one would need
to define "Fixed-field Encoding Rules" (FER) which would place only data
(not tag or length) octets in the datastream, and a set of macros to
conveniently represent the necessary fields.
I dunno about IPSEC, but I'm pretty sure you could shoehorn the SSL encoding
into it without too much trouble, it's just a stripped-down ASN.1+DER (the
best description I can think of is a kiddies ASN.1, without meaning that in a
negative way). I've even seen an attempt at EDI using an ASN.1-like notation,
although the result was... unpleasant (actually I think Colonel Kurtz had
appropriate words for the result).
Peter.
I've been toying with this kind of idea recently, too. I was actually
thinking of PER instead of DER. I've only glanced through the PER spec,
but it seems to me that a stripped-down ASN.1 encoded with PER would be
easy to map into those 32-bit block diagrams you usually see in Internet
specs.
My reading of PER is that it provides a way to strip out as much of the
tag and length values as possible. To me, this most closely resembles
the "usual" Internet way of specifying a protocol -- the first four
bytes are a value for foo, the next two are for a bar, etc.
It's obvious that many people don't like ASN.1 for all sorts of
reasons. I believe that a definition of ASN.1 that allowed a reader to
easily visualize the bits on the wire would go a long way towards making
ASN.1 more acceptable to the Internet community. This thought led to my
speculations about a "thin" ASN.1 and PER. I can even envision a Perl
script that takes thin ASN.1 and spits out a 32-bit block diagram...
I'm happy to work with someone on this sort of thing if people think it
has merit.
M.
+------------------------------------------------------------------------+
Marc Branchaud \/
Chief PKI Architect /\CERT INTERNATIONAL
INC.
marcnarc(_at_)xcert(_dot_)com PKI References page:
www.xcert.com
604-640-6227 www.xcert.com/~marcnarc/PKI/
+------------------------------------------------------------------------+
PGP key fingerprint: 60 11 4B 9D 4E E5 2F 47 BD C5 C2 BF 26 DF 5A E1