Re: encoding an X.509 certificate

["Tom Scavo" <trscavo@xxxxxxxxx>]

On Thu, Nov 6, 2008 at 1:52 PM, Santosh Chokhani <SChokhani@xxxxxxxxxxxx> wrote:
> DER Vs Base 64 is not the correct trade-off.

Sorry, I didn't make that very clear.  The XML Signature spec says the
certificate is base64 encoded before it is inserted in the XML but it
says nothing about the encoding of the underlying certificate, so the
question is, what ASN.1 encoding should be applied to the certificate
before it is base64 encoded?

> An X.509 certificate is always DER encoded.

That is the answer I was looking for, yes (although not everyone seems
to agree).

> After that for transport, do you send this as binary or convert the
> binary as base 64 is the trade-off.

The certificate is always base64 encoded before it is inserted in the XML.

Thanks!

Tom

> -----Original Message-----
> From: owner-ietf-pkix@xxxxxxxxxxxx [mailto:owner-ietf-pkix@xxxxxxxxxxxx]
> On Behalf Of Tom Scavo
> Sent: Thursday, November 06, 2008 12:49 PM
> To: pkix
> Subject: encoding an X.509 certificate
>
>
> I've asked the following question in a number of forums with no luck.
> I'm hoping someone with intimate knowledge of ASN.1 encodings can help
> me out here.  Many thanks in advance.
>
> Currently there are three profiles before the OASIS Security Services
> Technical Committee (SSTC) that rely on XML elements of the form:
>
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
>  <ds:X509Data>
>   <ds:X509Certificate>
> MII...
>   </ds:X509Certificate>
>  </ds:X509Data>
> </ds:KeyInfo>
>
> Interestingly, the above element has sparked a vigorous debate within
> the SSTC, which has since spread to the W3C XML Signature WG.  The
> issue involves the ASN.1 encoding of the underlying certificate (which
> is base64 encoded in the XML).  Specifically, should the certificate
> be DER-encoded or should the encoding be left unspecified?
>
> So my question is:  If you were given an X.509 certificate of unknown
> encoding, could you determine the encoding by simply inspecting the
> bytes?  Does your favorite ASN.1 library support such a function?
>
> Thanks for shedding some light on this issue.
>
> Tom Scavo
> NCSA
>
>