id-ce-cRLDistributionPoints ASN.1 / DER encoding question

Question

I have a file - test.pem - with the following contents:

-----BEGIN CERTIFICATE-----
MBIwEKAOoAwwCqMIMAZhBEFCQ0Q=
-----END CERTIFICATE-----

openssl asn1parse -inform PEM -in test.pem -i returns the following:

    0:d=0  hl=2 l=  18 cons: SEQUENCE
    2:d=1  hl=2 l=  16 cons:  SEQUENCE
    4:d=2  hl=2 l=  14 cons:   cont [ 0 ]
    6:d=3  hl=2 l=  12 cons:    cont [ 0 ]
    8:d=4  hl=2 l=  10 cons:     SEQUENCE
   10:d=5  hl=2 l=   8 cons:      cont [ 3 ]
   12:d=6  hl=2 l=   6 cons:       SEQUENCE
   14:d=7  hl=2 l=   4 cons:        appl [ 1 ]
Error in encoding
19480:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:

Here's what it corresponds to in hex:

00000000  30:10:30:0e:a0:0c:a0:0a:30:08:a3:06:30:04:61:02  0.0.....0...0.a.
00000010  58:58                                            XX

Hand-decoding it I get this:

SEQUENCE {
  SEQUENCE {
    [0] {
      [0] {
        SEQUENCE {
          [3] {
            SEQUENCE {
              [APPLICATION 1] XX
            }
          }
        }
      }
    }
  }
}

So it seems to work to me. Why doesn't asn1parse like it? Here's the ASN.1 mapping it corresponds to:

http://pastebin.com/NyKDK0ph

Answer 1

The definitions posted here via the link are incomplete, but after supplying definitions for all of the undefined types, I get a similar error message from the OSS Nokalva ASN.1 Studio utility. The last byte you display here is a length (58 hex 88 decimal), but based on the second byte (hex 10, dec 16) the total length of the encoding is 16, so 88 more bytes cannot be found in the buffer based on that outer length, thus the error message on encountering that length of 88.

Paul