Hi Ari,
On Tue, Oct 7, 2008 at 4:40 PM, ARI KERMAIER <> wrote:
>
> What's meant by "the DER-encoded Subject Key Identifier (SKI) extension"?
Oops, I copied existing text from the profile document but didn't
sufficiently edit.
> Is it the entire DER-encoded Extension object, which is a sequence of OID, critical flag and value?
> Or is it the value field, which is an ASN.1 OCTET STRING, including its ASN.1 DER-encoded tags?
> Or is it the bytes of the SKI value, i.e., the content of the OCTET STRING without its tags?
>
> I would favor the last of these options, so we don't assume ASN.1 parsing capability on the part of an XML protocol implementation.
Yes, I think you're right. In fact, [XMLSig] says
"The X509SKI element, which contains the base64 encoded plain (i.e.
non-DER-encoded) value of a X509 V.3 SubjectKeyIdentifier extension."
which I believe agrees with your preference. This leads to the
following rewrite of the normative text to be included in the HoK
Assertion Profile:
"The <ds:X509Data> element MAY contain a <ds:X509SKI> element. If it
does, the <ds:X509SKI> element MUST contain the base64 encoding of the
plain (i.e., not DER-encoded) value of the Subject Key Identifier
(SKI) extension of an X.509 certificate (as specified in [XMLSig]).
If the certificate does not contain an SKI extension, the
<ds:X509Data> element MUST NOT contain a <ds:X509SKI> element."
If you prefer some different wording, let me know.
Tom
