Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the X.509 RFC, in the "Implicitly Tagged Module" section:

CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

DistributionPoint ::= SEQUENCE {
     distributionPoint       [0]     DistributionPointName OPTIONAL,
     reasons                 [1]     ReasonFlags OPTIONAL,
     cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

GeneralName ::= CHOICE {
     otherName                 [0]  AnotherName,
     rfc822Name                [1]  IA5String,
     dNSName                   [2]  IA5String,
     x400Address               [3]  ORAddress,
     directoryName             [4]  Name,
     ediPartyName              [5]  EDIPartyName,
     uniformResourceIdentifier [6]  IA5String,
     iPAddress                 [7]  OCTET STRING,
     registeredID              [8]  OBJECT IDENTIFIER }

How would x400Address be encoded? Like this?:

SEQUENCE {
  SEQUENCE {
    [0] {
      [3] {
        ...
        }
      }
    }
  }

The first [0] is from DistributionPoint (which is replacing DistributionPointName's [0] tag) and the [3] is from GeneralName.

If that's how it's supposed to work, though, then why does DistributionPoint even have context-specific tags?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You will get something like this:

SEQUENCE {
  SEQUENCE {
    [0] {
      [0] {
        [3] {
          ...
        }
      }
    }
  }
}

Explanations:

  1. Even though the tags are supposed to be implicit (due to being in a module declared with IMPLICIT TAGS), implicit tags cannot be applied to a CHOICE (because otherwise the CHOICE would not work at all), so they are automatically converted to explicit tags in that situation. Here, the [0] tag on the distributionPoint field is in such a situation, so it wraps around, instead of replacing, the tag of the DistributionPointName field, which is also a [0].

  2. Notice that fullName has type GeneralNames, not GeneralName. You do not quote GeneralNames in your message; it is a SEQUENCE OF GeneralName. The [0] implicit tag of the fullName field, being implicit, replaces that of the SEQUENCE.

For the first point, it is specified in X.680, clause 28.6 (from the 1994 version):

The tagging construction specifies explicit tagging if any of the following holds:

a) the "Tag EXPLICIT Type" alternative is used;

b) the "Tag Type" alternative is used and the value of "TagDefault" for the module is either "EXPLICIT TAGS" or is empty;

c) the "Tag Type" alternative is used and the value of "TagDefault" for the module is "IMPLICIT TAGS" or "AUTOMATIC TAGS", but the type defined by "Type" is a choice type, open type, or a "DummyReference" (see ITU-T Rec. X.683 | ISO/IEC 8824-4, clause 8.3).

The last clause (c) is what I explain above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.