[2246] in Kerberos
Kerberos V5 ASN.1 observation
daemon@ATHENA.MIT.EDU (John Linn. LKG1-2/A19. {(508)-486 )
Fri Oct 2 09:39:21 1992
Date: Fri, 2 Oct 92 09:08:00 EDT
From: John Linn. LKG1-2/A19. {(508)-486 or DTN 226}-7384. 02-Oct-1992 0910 <linn@albeit.enet.dec.com>
To: kerberos@Athena.MIT.EDU, kaufman@kibitz.enet.dec.com
Cc: linn@albeit.enet.dec.com
Apparently-To: kerberos@athena.mit.edu
Charlie Kaufman writes:
>In looking at the ASN.1 for Kerberos V5, it appears that the data
>structures could be made much more compact through liberal use of
>IMPLICIT to get rid of extra tags. Not being an ASN.1 expert, I'm
>wondering whether IMPLICIT is the default given the tools you are using. (?)
In looking at the Kerberos V5 ASN.1 and the tagging employed therein, I
observed a property which I found desirable, though I'm not sure whether
it was explicitly intentional or arose by fortutious coincidence. Since
Kerberos V5 tokens all carry [APPLICATION xx] tags, where xx is
non-zero, it's always possible to distinguish a "bare" Kerberos token
from the beginning of a token which is wrapped along with a mechanism
type Object Identifier per GSS-API (Internet-Draft
draft-ietf-cat-genericsec-02) Appendix B, where the first token of a
context establishment sequence is tagged as follows:
InitialContextToken ::=
[APPLICATION 0] IMPLICIT SEQUENCE {
thisMech MechType -- MechType is OBJECT IDENTIFIER
innerContextToken ANY DEFINED BY thisMech
-- contents mechanism-specific
}
thereby yielding a BER with a first octet of:
60 -- Application, Constructed, Tag=0
distinguishable from a Kerberos V5 token sans wrapper. I believe that
it would be a Good Thing to assure that any future changes to the
Kerberos or GSS-API ASN.1 preserve this disambiguation property.
--jl
