RE: encoding an X.509 certificate

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Kemp, David P." <DPKemp@xxxxxxxxxxxxxx> writes:

>The same thing that happens to people who don't lint or bounds-check their C
>code - it works most of the time, so it must not matter if the code is
>actually correct.  "X.509 dogma" is just for anal people who want 100%
>reliability.

If you follow the spec in this regard you get 100% unreliability, not
reliability - your PKI application when shipped will break repeatedly whenever
it encounters a non-DER certificate, while everything else will work just
fine.  So "X.509 dogma" is for X.509 dogmatists and pretty much no-one else.

(I actually had a bit of trouble replying to this message, it's not often that
 you see the terms "100% reliability" and "X.509" used in the same sentence 
 (in fact this may be the first time I've ever seen it without a negation in
 there as well), there were so many ways I could have replied to this :-).

Peter.