Re: CRL verification problem

Hello, thanks for reply! Sorry for the delay to answer.

I understand what you mean, but consider this scenario: 

This CRL contains DEFAULT values encoded in its structure. In the RFC, 

"Implementers should note that the DER encoding of SET or SEQUENCE
components whose value is the DEFAULT omit the component from the
encoded certificate or CRL. For example, a BasicConstraints
extension whose cA value is FALSE would omit the cA boolean from the
encoded certificate." 

This quote indicates to omit default values when encoding. But it doesn't
forbid the encode, right?

I mean, if a CRL encodes a DEFAULT value in tbsCertificate, shouldn't this
value be present in the hash calculation?

"The signatureValue field contains a digital signature computed upon the
ASN.1 DER encoded tbsCertList."

We understand this quote indicates to calculate signatureValue upon
tbsCertList, independent if the tbsCertList contains DEFAULT values or not.



--
Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html