Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the X.509 specs:

   CRLReason ::= ENUMERATED {
        unspecified             (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
             -- value 7 is not used
        removeFromCRL           (8),
        privilegeWithdrawn      (9),
        aACompromise           (10) }

...and...

Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }

Why isn't Version an ENUMERATED type? And similarly, why isn't CRLReason an INTEGER?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

ENUMERATED and INTEGER are almost identical (they just use distinct tags). The generic idea is that ENUMERATED is for a choice within a bounded set of possible values, whereas INTEGER is for values which could, at least theoretically, raise indefinitely.

Here, the use of ENUMERATED for CRLReasons is a hint which says that "there shall be no other reason in the future", whereas there may well be other protocol versions (possibly many others).

Now that's just a declaration of intent, which will not be enforced in any way. Remember that the justification of most of ASN.1 is: "it looked like a good idea at that time". Do not try to read too much in it. After all, ASN.1 succeeded in defining, well into the 1980s, a format for dates which has only two digits for the year -- a glaring Y2K issue, which did not deter the standardization committee... so just accept the ENUMERATED/INTEGER duality as one of the numerous quirks of ASN.1 (it's not the worse).

share|improve this answer

ENUMERATED and INTEGER serve different purposes. ENUMERATED is for creating a list of named items while INTEGER is for carrying numbers. The fact that the type notation seems somewhat similar does not make them identical. For ENUMERATED, the only values permitted are those named in the list. For INTEGER, the named list is just a set of useful labels for specific numbers, and does not limit what values are permitted for the INTEGER type.

I can only assume that CRLReason was made ENUMERATED because there is a closed set of values while Version was made an INTEGER to leave the number of future versions open ended.

Feel free to try some of these specifications at http://asn1-playground.oss.com, which is an online ASN.1 compiler and encoder/decoder that supports not only BER and DER, but also PER, XER and CER. You will be able to see that differences between ENUMERATED and INTEGER seem more significant for other encoding rules (such as PER and XER) than they seem for BER and DER.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.