Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a file - test.pem - with the following contents:

-----BEGIN CERTIFICATE-----
MBIwEKAOoAwwCqMIMAZhBEFCQ0Q=
-----END CERTIFICATE-----

openssl asn1parse -inform PEM -in test.pem -i returns the following:

    0:d=0  hl=2 l=  18 cons: SEQUENCE
    2:d=1  hl=2 l=  16 cons:  SEQUENCE
    4:d=2  hl=2 l=  14 cons:   cont [ 0 ]
    6:d=3  hl=2 l=  12 cons:    cont [ 0 ]
    8:d=4  hl=2 l=  10 cons:     SEQUENCE
   10:d=5  hl=2 l=   8 cons:      cont [ 3 ]
   12:d=6  hl=2 l=   6 cons:       SEQUENCE
   14:d=7  hl=2 l=   4 cons:        appl [ 1 ]
Error in encoding
19480:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:

Here's what it corresponds to in hex:

00000000  30:10:30:0e:a0:0c:a0:0a:30:08:a3:06:30:04:61:02  0.0.....0...0.a.
00000010  58:58                                            XX

Hand-decoding it I get this:

SEQUENCE {
  SEQUENCE {
    [0] {
      [0] {
        SEQUENCE {
          [3] {
            SEQUENCE {
              [APPLICATION 1] XX
            }
          }
        }
      }
    }
  }
}

So it seems to work to me. Why doesn't asn1parse like it? Here's the ASN.1 mapping it corresponds to:

http://pastebin.com/NyKDK0ph

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The definitions posted here via the link are incomplete, but after supplying definitions for all of the undefined types, I get a similar error message from the OSS Nokalva ASN.1 Studio utility. The last byte you display here is a length (58 hex 88 decimal), but based on the second byte (hex 10, dec 16) the total length of the encoding is 16, so 88 more bytes cannot be found in the buffer based on that outer length, thus the error message on encountering that length of 88.

Paul

share|improve this answer
    
You're right - the constructed bit is set for 0x61, which means that 0x02 is the length and 0x58 is the next tag type with the last 0x58 being the length of that tag. Thanks! –  compcert Feb 24 '12 at 7:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.