Skip to main content
8 votes
Accepted

representing binary finite fields in ASN.1

For a binary field $\mathbb{F}_{2^m}$, the polynomial necessarily has degree $m$ (otherwise the field would not have cardinal $2^m$), and its least significant coefficient must be $1$, not $0$ (...
Thomas Pornin's user avatar
8 votes
Accepted

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

The "extra" octet is needed because ASN.1 uses two's complement notation for integers, per section 8.3.3 of X.690: The contents octets shall be a two's complement binary number equal to the ...
Marc's user avatar
  • 1,583
6 votes
Accepted

PKCS#7 CMS - Message digest calculation process

Closely related: What does CMS standard mean by "initial input to the message digest" The signature schemes envisioned by PKCS7/CMS use two stages, where the data to be signed is first ...
dave_thompson_085's user avatar
6 votes
Accepted

Converting raw ECC private key into ASN.1 DER encoded key

ASN.1 is a way of defining structures for data, and DER is a binary encoding of those structures. But they aren't describing any structures by themselves. Saying that something needs to be ASN.1 / DER ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes

Why is the signatureAlgorithm field in X.509 certificates redundant?

There is no difference. RFC 5280 even requires $\tt signatureAlgorithm$ and $\tt signature$ to be the same. According to this discussion on the PKIX mailing list, the reason for the redundancy is that ...
dade's user avatar
  • 1,323
6 votes
Accepted

Why is the signatureAlgorithm field in X.509 certificates redundant?

From RFC 5280 r.e TBSCertificate.signature This field contains the algorithm identifier for the algorithm used by the CA to sign the certificate. This field MUST contain the same algorithm ...
Chris's user avatar
  • 819
5 votes
Accepted

BER or DER X9.62 for ECDSA signature

Annex E of X9.62-2005 says: Annex E provides the syntax for elliptic curve cryptography, including domain parameters, keys and signatures, according to Abstract Syntax Notation One (ASN.1). Although ...
Thomas Pornin's user avatar
4 votes
Accepted

What are these fields in ASN.1 encoding of RSA

The are the $d_P$, $d_Q$ and of course $q_{inv}$ - in that order - in the Wikipedia article. As you can see in the formulas relating to the Chinese Remainder Theorem the primes are also used but $d$, ...
Maarten Bodewes's user avatar
  • 93.2k
4 votes
Accepted

Why is an RSA public key BITWRAP-ed in ASN.1 DER encoding?

That is a Subject Public Key Info structure defined by the X.509 standard: ...
Conrado's user avatar
  • 6,484
3 votes
Accepted

Where can I read about DER certificate structure - fields and its registered values?

ASN.1 is defined by the International Telecommunication Union (the ITU). ASN.1 stands for Abstract Syntax Notation One, and is a schema definition language. DER, as well as its base form BER, are ...
DannyNiu's user avatar
  • 9,451
3 votes
Accepted

What's the ASN.1 structure of ECIES encryption result?

The public key structure is an X.509 SubjectPublicKeyInfo for ECC (public) key, using explicit format instead of (more common and popular) 'named' format. SPKI is a generic ASN.1 structure that ...
dave_thompson_085's user avatar
3 votes

ASN.1 encoding off RSASSA-PSS default parameters

The first answer is correct, I just want to add the correct clause from ITU-T X.690: clause 11.5 titled "Set and sequence components with default value", cite: "The encoding of a set ...
GermanDev's user avatar
3 votes

Length of message in RSA and splitting of long messages

Yes, hybrid crytography is generally used; hybrid crypto combines asymmetric cryptography with a fast symmetric cipher to do the bulk of the work. Either the keys are generated using RSA-KEM (and a ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

Converting a "raw" non-ASN.1 EC private key to a public key?

Without knowing which domain parameters were used this question is impossible to answer. The problem is that the value of the private key is random within the domain. So although we know that the key ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

Are EdDSA algorithms encoded by ASN.1 DER standards?

An EdDSA signature is a sequence of bytes encoded according to the EdDSA paper or its extension to more curves, or according to RFC 8032, which should be treated as opaque by callers. In particular, ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

PKCS#7 non-detached Signature - Help understand the message structure

The practical answer to this is: use a library. There are many available, and they already handle the complicated details below plus many more that exist in PKCS7/CMS in general but are not in this ...
dave_thompson_085's user avatar
2 votes

Why is the signature field in X.509 a BIT STRING, despite there being ASN.1 (DER) data inside?

However, at least for the rsaEncryption algorithm, there's ASN.1 DER data inside (representing the signature). This is not actually the case. It is the case for - for instance - DSA and ECDSA, where ...
Maarten Bodewes's user avatar
  • 93.2k
2 votes

Why is the signature field in X.509 a BIT STRING, despite there being ASN.1 (DER) data inside?

The contents of the signature field is dependent on the signatureAlgorithm being used. So it can hold anything (including DER serialisation) for as long as it's ...
Ilya Etingof's user avatar
2 votes

BER or DER X9.62 for ECDSA signature

According to Section 6 of X9.62-1998, any encoding may be used: While it is likely that these ASN.1 definitions will be encoded using the Distinguished Encoding Rules (DER), other encoding rules ...
Conrado's user avatar
  • 6,484
2 votes
Accepted

Correcting Improperly Formatted EC Private Keys

Yes, it seems related: the private key just misses a 00 value (not a 01 value) in front. The problem that the I2OS primitive ...
Maarten Bodewes's user avatar
  • 93.2k
2 votes
Accepted

X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

No, the 00 simply indicates how many least significant bits are not used in the last octet of the BIT STRING. As the bit string contains an octet string (...
Maarten Bodewes's user avatar
  • 93.2k
2 votes
Accepted

ASN.1 integer question for DSA

The question has the following things correct: $(p,q,g)$ = (0x8df2…0291, 0xc773…915f, ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

Do RSA powers of two modulus always have MSB set to one and so when DER encoded have 0x00 prefix?

Yes, it is always so, if just because the key size is actually the size of the modulus for RSA. The sizes of the primes that produce the modulus should be selected so that the key size is between $[2^{...
Maarten Bodewes's user avatar
  • 93.2k
2 votes

Encode ASN.1 PKCS#8 Private Key with Public Key and attributes

This is more about representation and manipulation of data in a computer program than cryptography. Questions about Dart or the use of libraries in Dart, are better asked on Stackoverflow. The [0] and ...
dave_thompson_085's user avatar
1 vote

openSSL created CSR signature size of 73 bytes but should't it be 70 bytes

I don't have enough reputation to add a comment on the excellent answer my @marc above but you also need to be aware that ASN.1 removes leading zero bytes apart from a single zero byte if required for ...
Roger Lucas's user avatar
1 vote

Are there any existing ASN.1 structures for transferring symmetric keys?

For the algorithm you should use the AlgorithmIdentifier type of RFC5280. Block size and key size can be derived from the algorithm id and the key itself, so there ...
mat's user avatar
  • 2,528
1 vote

What does OIW stand for

Disclaimer: My interest in this post arise from a question of mine, which I intend to answer some day later after writing up this one. OIW stands for OSI Implementors' Workshop. This group was ...
DannyNiu's user avatar
  • 9,451

Only top scored, non community-wiki answers of a minimum length are eligible