Re: Re: CRL verification problem

Yes, the CRL is allowed to contain the encoding of default values, but
no, if there are included they are not to be included in the hash
calculation.

Regards,

David

On 12/12/19 6:43 am, luizurias wrote:
> Hello, thanks for reply! Sorry for the delay to answer.
>
> I understand what you mean, but consider this scenario: 
>
> This CRL contains DEFAULT values encoded in its structure. In the RFC, 
>
> "Implementers should note that the DER encoding of SET or SEQUENCE
> components whose value is the DEFAULT omit the component from the
> encoded certificate or CRL. For example, a BasicConstraints
> extension whose cA value is FALSE would omit the cA boolean from the
> encoded certificate." 
>
> This quote indicates to omit default values when encoding. But it doesn't
> forbid the encode, right?
>
> I mean, if a CRL encodes a DEFAULT value in tbsCertificate, shouldn't this
> value be present in the hash calculation?
>
> "The signatureValue field contains a digital signature computed upon the
> ASN.1 DER encoded tbsCertList."
>
> We understand this quote indicates to calculate signatureValue upon
> tbsCertList, independent if the tbsCertList contains DEFAULT values or not.
>
>
>
> --
> Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html
>
>