der: add EncodingRules enum
#1321
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds an enum with `Ber` and `Der` (default) variants which can be used to selectively allow a limited number of BER productions when decoding certain BER-based security-oriented formats, e.g. CMS, PKCS#8. Currently this doesn't actually do anything, however the goal is to address #779, where we can't decode CMS generated by Apple tooling. PR #810 is an example of how the rules could be relaxed to support `IndefiniteLength`s.
Closed
dwhjames
added a commit
to dwhjames/RustCrypto-formats
that referenced
this pull request
Feb 9, 2025
Issue RustCrypto#779 has had some process (PR RustCrypto#1321). However, this helper function is intended to provide an escape hatch for limited support of some cases of BER, while not waiting for general support or needing API changes. Specifically, the transcoding of occurrences of the constructed, indefinite-length method into the constructed, definite-length method. This is likely sufficient to address the examples in the wild, reported in Issue RustCrypto#779 and elsewhere. The goal is not to support all possible violations of DER that are still following valid BER. Examples are non-canonical encodings of lengths (which would require an alternative `Length`), or constructed string types (which could be handled by further work on this function, but usage may not be well motivated).
dwhjames
added a commit
to dwhjames/RustCrypto-formats
that referenced
this pull request
Feb 9, 2025
Issue RustCrypto#779 has had some process (PR RustCrypto#1321). However, this helper function is intended to provide an escape hatch for limited support of some cases of BER, while not waiting for general support or needing API changes. Specifically, the transcoding of occurrences of the constructed, indefinite-length method into the constructed, definite-length method. This is likely sufficient to address the examples in the wild, reported in Issue RustCrypto#779 and elsewhere. The goal is not to support all possible violations of DER that are still following valid BER. Examples are non-canonical encodings of lengths (which would require an alternative `Length`), or constructed string types (which could be handled by further work on this function, but usage may not be well motivated).
dwhjames
added a commit
to dwhjames/RustCrypto-formats
that referenced
this pull request
Feb 9, 2025
Issue RustCrypto#779 has had some progress (PR RustCrypto#1321). However, this helper function is intended to provide an escape hatch for limited support of some cases of BER, while not waiting for general support or needing API changes. Specifically, the transcoding of occurrences of the constructed, indefinite-length method into the constructed, definite-length method. This is likely sufficient to address the examples in the wild, reported in Issue RustCrypto#779 and elsewhere. The goal is not to support all possible violations of DER that are still following valid BER. Examples are non-canonical encodings of lengths (which would require an alternative `Length`), or constructed string types (which could be handled by further work on this function, but usage may not be well motivated).
dwhjames
added a commit
to dwhjames/RustCrypto-formats
that referenced
this pull request
Feb 9, 2025
Issue RustCrypto#779 has had some progress (PR RustCrypto#1321). However, this helper function is intended to provide an escape hatch for limited support of some cases of BER, while not waiting for general support or needing API changes. Specifically, the transcoding of occurrences of the constructed, indefinite-length method into the constructed, definite-length method. This is likely sufficient to address the examples in the wild, reported in Issue RustCrypto#779 and elsewhere. The goal is not to support all possible violations of DER that are still following valid BER. Examples are non-canonical encodings of lengths (which would require an alternative `Length`), or constructed string types (which could be handled by further work on this function, but usage may not be well motivated).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds an enum with
BerandDer(default) variants which can be used to selectively allow a limited number of BER productions when decoding certain BER-based security-oriented formats, e.g. CMS, PKCS#8.Currently this doesn't actually do anything, however the goal is to address #779, where we can't decode CMS generated by Apple tooling.
PR #810 is an example of how the rules could be relaxed to support
IndefiniteLengths.