From: Brian Candler <B.Candler@...>
Date: 2005-04-10T23:51:26+09:00
Subject: Re: Ruby ASN1 examples?

On Sun, Apr 10, 2005 at 01:07:10AM +0900, Sam Roberts wrote:
> > If we go down that route, then what I'd really want is bindings between
> > arbitary Ruby classes and ASN1 types (including set/sequence/choice), so
> > that a tree of objects can be converted to and from der. Attached is one
> > idea how this might look.
> 
> 
> I'd suggest not doing that. Its a common desire, but it leads to
> incredible problems down the road.
> 
> Problems:
> - String has multiple representations in ASN.1. To encode it, you need
>   to choose the String type. Particularly for DER, this causes
>   round-trip problems - you decode a TeletexString to ruby String, then
>   reencode, it gets encoded as UTF8String, and now you have mangled the
>   data. In particular, cryptographic signatures fail.

A solution would be to mark each attribute in the class with its ASN.1 type:
e.g.

class Foo
  attr_accessor :bar, :baz

  asn1_attr :bar, OpenSSL::ASN1::ISO64String
  asn1_attr :baz, OpenSSL::ASN1::UTF8String
end

Serialising Foo to der will then tag @bar and @baz correctly.

If there's a possibility that a single attribute will be one of multiple
types, then it should be wrapped in an ASN.1 'choice'

> - Memory overhead goes through the roof, because ASN.1 is very verbose.
>   This is a variation of what happened in the XML world. XML looks like
>   a tree, so people write tree-based APIs. Fast and easy... then they
>   get a large document, or try and figure out why their code is so slow,
>   and end up having to change to SAX, or some other stream-based API.

Sure, although it depends on how complex your object tree is. The existence
of stream APIs for XML doesn't mean that in-memory data structure APIs for
XML are worthless, and I think the same applies to ASN.1

I'm not intimately familiar with OpenSSL's ASN.1 routines, for example, but
they do seem to be memory-based (ASN1_OBJECT_new, ASN1_OBJECT_free etc)

I don't see ASN.1 as a general-purpose object serialisation tool
incidentally; in particular, having object references and graphs of objects
would be a bit of a nightmare. I'm just interested in a toolset for encoding
and decoding ASN.1 messages.

Incidentally, Ruby's ASN.1 library does appear to have a 'traverse' method
which acts as a stream parser. You still need to build a suitable state
machine for it to 'yield' each element to, of course.

> Btw, DJBs name is a bad word in the mail community, and I'm deeply
> suspicious of anybody who suggests that somehow ASN.1 is "simpler" than
> the IETF text-based protocols. I've implemented both, and its not true.

Was it DJB who suggested this? I only came across it in J.deBoynePollard's
protocol (which stemmed from DJB's initial idea, but I don't think that
specified what form the protocol should take)

> Anyhow, have fun, implementing protocols is usually lots of that, its
> pretty cool to pull up the hood and see how things really work!

Exactly. Whilst I don't believe JdeBP's proposal is by itself an improvement
on what we have now for E-mail, it's given me a chance to think it through,
and having a bash at implementation might bring up some more ideas.
http://pobox.com/~b.candler/doc/misc/im2000.html

Cheers,

Brian.