Re: Encoding of INTEGER fields in PKIX certs

["Charles W. Gardiner" <gardiner@xxxxxxx>]

    I think it is better to stick with the ASN.1 rule that the most significant
bit of an INTEGER is the sign.  Since p, q, g, x, and y are positive numbers,
they should have the extra null byte if the high bit is set -- as it always is
with p and q.  Note also that some values, particularly the r part of a
signature may have a null byte in the high position and not have the next lower
bit set.  In that case the proper encoding -- even with BER -- is of a 19-byte
string, e.g. 0x0033445566.... becomes 0x021333445566....  Consequently
applications must be able to handle instances where the INTEGERS are of
different sizes from the parameters.

    To make an exception for "big numbers" (how big is big?) seems to me to be a
mistake.

Charlie Gardiner