Subversion Repositories oidinfo_new_design

Rev

Blame | Last modification | View Log | RSS feed

  1. <html><head>
  2. <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"></head><body><pre>Study about OID encoding and size limitations
  3. Daniel Marschall, 19. June 2011
  4.  
  5. INTERESTING FACTS ABOUT THE BER ENCODING OF OIDS:
  6.  
  7. - An OID is encoded in following DER format: "[classtag] [length] [data]"
  8. - [classtag] = 0x06 + modified bit 7/6 for OBJECT IDENTIFIER
  9.                0x0D + modified bit 7/6 for RELATIVE OID
  10. - [length] is encoded as follows:
  11.   0x00 .. 0x7F = The actual length is in this byte, followed by [data].
  12.   0x80 + n     = The length of [data] is spread over the following 'n' bytes. (0 &lt; n &lt; 0x7F)
  13.   0x80         = "indefinite length" (only constructed form) -- Invalid
  14.   0xFF         = Reserved for further implementations -- Invalid
  15.   See page 396 of "ASN.1 - Communication between Heterogeneous Systems" by Olivier Dubuisson.
  16. - The top-level arcs were limited to 3 standard bodies "0" (iso), "1" (itu-t) and "2" (joint-iso-itu-t) in 1986 .
  17. - It is NOT possible to encode any OID with root 3 or higher
  18. - It is NOT possible to encode any root OID without any second element (e.g. "1")
  19. - The OIDs { 0 0 } until { 0 39 } are encoding into 1 octet. ( "06 01 00" till "06 01 27" )
  20. - It is NOT possible to encode { 0 x } with x &gt;= 40
  21. - The OIDs { 1 0 } until { 1 39 } are encoding into 1 octet. ( "06 01 28" till "06 01 4F" )
  22. - It is NOT possible to encode { 1 x } with x &gt;= 40
  23. - The OIDs { 2 0 } until { 2 47 } are encoding into 1 octet. ( "06 01 50" till "06 01 7F" )
  24. - It *IS* possible to encode { 2 x } with x &gt;= 40
  25. - It *IS* possible to encode { 2 x } with x &gt;= 47
  26. - The OIDs { 2 48 } till { 2 unlimited } encodes into 2 or more octets, while the highest is defined as "more" bit, like it is defined at the higher levels.
  27. - Please note that you have to subtract 0x50 (80) from the second value, but not on any other value.
  28.   Example: { 2 0 999 } is "06 03 50 87 67". { 2 0 } does encode into "50" and "999" got encoded to "87 67" at the third resp. any higher level.
  29.   But: { 2 999 } is encoded into "06 02 88 37". "88 37" does encode into "999" at the second level and not to "1079". (Difference: 80)
  30. - The encoding of the example OID { 2 999 } is "06 02 88 37".
  31.  
  32. SOME FACTS ABOUT COMPATIBILITY OF LARGE OID IDENTIFIERS (E.G. UUIDS):
  33.  
  34. - Windows CryptoAPI Shell Extension (tested with: XP, 7) as well as Mozilla software cannot handle UUID OIDs (128 bit)!
  35. - The maximum useable OID value in Windows is 2^64-1 (e.g. 2.999.18446744073709551615).
  36.   Windows will show whitespace when any higher value occours.
  37. - The maximum useable OID value in Mozilla software is 2^32-1 (e.g. 2.999.4294967295)
  38.   The program will show "Unknown" when an arc contains a higher value. (e.g. {2 999 Unknown 0})
  39. - OpenSSL (0.9.8o 01 Jun 2010) can handle UUID OIDs. It seems that the maximum value is not limited!
  40.   (I have tested the encoding/decoding/matching until 2^4096!)
  41. - OpenSSL cannot encode the values 4294967296..4294967299 due to a bug. (See below)
  42.  
  43. BUG IN OPENSSL: WRONG ENCODING OF VALUES 4294967296..4294967299
  44.  
  45. - OpenSSL 0.9.8o 01 Jun 2010
  46.   OpenSSL has problems encoding OIDs which are at the border of 32 bit range.
  47.   I tested encoding several OIDs in the "new_oids" section to generate attributes.
  48.   OpenSSL encodes the OID 2.999.4294967295 (4294967295 = 2^32-1) correctly.
  49.   OpenSSL encodes the OID 2.999.4294967296 (4294967296 = 2^32  ) into "06 03 88 37 00" which is 2.999.0 !
  50.   OpenSSL encodes the OID 2.999.4294967297 (4294967297 = 2^32+1) into "06 03 88 37 01" which is 2.999.1 !
  51.   OpenSSL encodes the OID 2.999.4294967298 (4294967298 = 2^32+2) into "06 03 88 37 02" which is 2.999.2 !
  52.   OpenSSL encodes the OID 2.999.4294967299 (4294967299 = 2^32+3) into "06 03 88 37 03" which is 2.999.3 !
  53.   OpenSSL encodes the OID 2.999.4294967300 (4294967300 = 2^32+4) correctly.
  54.   (Probably here the program turns too late into the arbitrary-number mode?)
  55.   ==&gt; The values 4294967296..4294967299 are accidently interpreted as 0..3
  56.   ==&gt; 4294967300 and higher are encoded correctly again.
  57.   This seems to be a bug and not a range limitation, since OpenSSL can successfully create certificates
  58.   with 64-, 128-, 256-, 512- and even 1024-Bit OIDs!! (Which is amazing compared to the Windows CryptoAPI
  59.   Shell Extensions which are limited to 64 bits)
  60.   Please note that only the CREATION of such a certificate is buggy. When I edit the certificate with a
  61.   hex editor and then listing it with "-text -noout" the value "06 07 88 37 90 80 80 80 00"
  62.   decodes successfully in 2.999.4294967296 as well as "06 07 88 37 90 80 80 80 01" decodes successfully in
  63.   2.999.4294967297 and so on.
  64.   --&gt; Bug listed at <a href="http://rt.openssl.org/Ticket/Display.html?id=2542" target="_blank">RT#2542</a> (June 19th 2011)
  65.   --&gt; Bug solved at:
  66.       http://cvs.openssl.org/chngview?cn=21084
  67.       http://cvs.openssl.org/chngview?cn=21083
  68.       http://cvs.openssl.org/chngview?cn=21082
  69.       http://cvs.openssl.org/chngview?cn=21081
  70.  
  71. LIMITATION TO THE OID PRESENTATION INSIDE THE ATTRIUTE-FIELDS
  72.  
  73. - OpenSSL: In the output (-text -noout) listing, the OID values are limited to 79 characters.
  74.   Everything above this will be cutted in the OUTPUT (but the information is written correct inside the file).
  75.   If you are using an UUID, you are limited to use additional 35 characters (including dots).
  76.   OpenSSL don't seem to limit the depth of an OID.
  77. - While Windows CryptoAPI (tested with Windows 7, x86) don't seem to have any depth-limit, it limits the output size.
  78.   The program limits the size of the shown OID to 0xFF (255) characters, including dots.
  79.   If the OID dot-notation is longer than 255 bytes, the OID will be skipped and whitespace is instead shown.
  80. - While Mozilla Thunderbird/Firefox don't seem to have any depth-limit, it limits the output size.
  81.  The program limits the size of the shown OID to 299 characters, including dots.
  82.  Everything behind this limit is trimmed.
  83.  
  84. LIMITATION TO THE VALUE IN THE ATTRIBUTE-FIELDS
  85.  
  86. - Test certificate #2 (see below) contains a 36322 byte long value.
  87. - Mozilla, Windows and OpenSSL did show this value without limiting the output. There is probably no output limit at each of these programs.
  88.  
  89. OID SIZE LIMITATION IN OPENSSL (OpenSSL 0.9.8o 01 Jun 2010)
  90.  
  91. - OpenSSL can create and read OID values without any size limitation as it uses BigNumbers when the "long" datatype is exceeded.
  92. - While reading works, there was a bug in encoding the values 4294967296..4294967299 (see above).
  93.  
  94. OID SIZE LIMITATION IN WINDOWS (Windows XP, 7)
  95.  
  96. - The biggest object identifier value Windows CryptoAPI ShellExtension (tested with Windows XP and 7, both x86) can hold is
  97.  2^64-1 = 18446744073709551615
  98.  As soon as a value is greater or equal than 2^64, the OID will be skipped and whitespace is shown instead.
  99. - Windows is therefore not capable in showing UUID OIDs which have 128 bit identifiers.
  100.  
  101. OID SIZE LIMITATION IN MOZILLA FIREFOX/THUNDERBIRD
  102.  
  103. - Firefox and Thunderbird are worse than Microsoft Windows!
  104. - The biggest object identifier value Thunderbird (tested with Thunderbird/3.1.10 x86) can hold is
  105.  2^32-1 = 4294967295
  106.  As soon as a value is greater or equal than 2^32, the value will be shown as "Unknown", e.g. {2 999 Unknown 0}
  107. - Thunderbird is therefore not capable in showing UUID OIDs which have 128 bit identifiers.
  108. - I haven't tested it on Firefox 4, but it should be the same result.
  109.  
  110. OID SIZE LIMITATION IN OID-COVERTER
  111.  
  112. - The OID converter by Matthias Gaertner is not capable in UUIDs and has encoding problems with OIDs like 2.999 and cannot handle length greater than 0x7F (OpenSSL, Windows and Mozilla can handle them correctly)
  113. - I made great changes and <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-converter/">have updated</a> the program to version 1.5 which fixes
  114.   * the value-limitation is now removed
  115.   * the correct translation of OIDs above 2.40
  116.   * length can now be greater than 0x7F
  117.   * more errormessages (e.g. when trying to encode 0.40)
  118.   * added relative OIDs
  119.   * removed any command line size limits
  120.   * improved codestyle and some smaller fixes
  121. - Test it online: <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-converter/online.php">OID Converter</a>
  122.  
  123. ILLEGAL OID ENCODINGS
  124.  
  125. - Illegal OID encodings are:
  126.   * No valid OBJECT IDENTIFIER or RELATIVE-OID class tag used (e.g. <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-invalid-certs/type0x08.crt">type 0x08</a>)
  127.   * Length octet <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-invalid-certs/0x00.crt">0x00</a> used (OID cannot have zero length)
  128.   * Length octet <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-invalid-certs/0x80.crt">0x80</a> used (only valid for constructed types)
  129.   * Length octet <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-invalid-certs/0xff.crt">0xFF</a> used (reserved)
  130. - Behavior:
  131.  
  132.               0x00              0x80             0xFF                       Wrong type (0x08)
  133.     Windows   Whitespace shown  Cert incomplete  Cert incomplete            Cert incomplete
  134.     Mozilla   Binary garbage    Binary garbage   Certificate does not open  Certificate does not open
  135.     OpenSSL   Binary garbage    Error message    Error message              Error message
  136.     OID-Conv  Error message     Error message    Error message              Error message
  137.  
  138. OID SIZE TEST CERTIFICATES
  139.  
  140. - #1: To test the OID value size your client can handle, please download the <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-sizecheck/oid_size_test.crt">value limit test certificate</a>
  141.   (The signature is wrong because I edited the certificate because of the OpenSSL bug).
  142. - #2: To test if your client has limitations in the OID depth or the output size, please download the
  143.   <a href="http://www.viathinksoft.de/%7Edaniel-marschall/asn.1/oid-depthcheck/oid_depth_testcert.crt">OID depth limit and value length limit test certificate</a>.
  144.  
  145. Warning: As these X.509 certificates contain very unusual values, your software might crash. I am not responsible for any damages. Use at your own risk!
  146. </pre>
  147. </body></html>