Subject: Re: ASN.1 question on 2459

From: [email-masked] (Peter Gutmann)
Date: Thu, 30 Sep 1999 10:16:22 (NZST)

Re: ASN.1 question on 2459
Robert Moskowitz <[email-masked]> writes:

>What is the difference between the following two structures:
>
>::= SEQUENCE SIZE (1..MAX) OF
>
>::= SET OF
>
>To the casual reader they are both a collection of one or more thingees.

Originally SET of was a collection where order didn't matter and SEQUENCE was
one where it did, however SET has some really ugly encoding requirements under
the DER (you have to sort the elements of the set by encoded value and then
build the set in sorted order), current practice seems to be to use SEQUENCE
even where you really mean SET.

Peter.

---

From: Ben Laurie <[email-masked]>
Date: Thu, 30 Sep 1999 11:22:51 +0100

> even where you really mean SET.

Arg. No, it isn't. This is one of the first bugs I fixed in OpenSSL.

Unless you mean current practice is to write the ASN.1 to use a SEQUENCE
(rather than encode SET incorrectly)?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi