Re:An Empirical Study of Vulnerabilities in Cryptographic Li...
by memling on Sunday July 25, 2021 @01:25PM
(#27951065)
> I tried OSS NOKALVA's ASN.1 for Java but constraint checking is non-existent or very limited.
A quick look at their documentation suggests the use of the -constraints option.[1] Constraints are such a basic part of the ASN.1 specifications I can't imagine any vendor not implementing it. I know for a fact that Objective Systems' compiler does.[2]
[1]: https://www.oss.com/asn1/products/documentation/asn1_java_8....
Re:An Empirical Study of Vulnerabilities in Cryptographic Li...
by johnisgood on Sunday July 25, 2021 @05:39PM
(#27953158)
Thank you, I think I missed `-constraints`, then! I will give it a go and check out the generated file. I expected it to be turned on automatically. My bad! That said, I will check if it does the constraint checking properly. I hope it does!
I know, Erlang's ASN.1 compiler does it too, automatically. It is pretty awesome.
---
Update: `-constraints` does work (`validConstraint = temp1 >= 10 && temp1 <= 20`)
I will try out more complex ones. :)
What would you recommend for compiling and decoding/encoding ASN.1 using Java? I tried OSS NOKALVA's ASN.1 for Java but constraint checking is non-existent or very limited. I am forced to implement it myself as it does not exist from what I gathered. If you know one that does constraint checking, that would be amazing.
A quick search gave me this: https://github.com/yafred/asn1-tool/issues/13, so perhaps it does not seem so infeasible.
> I think if someone in the early 2000s had thought "I don't like the look of OpenSSL and I don't think C is a good choice of language. I'm going to write my own implementation of the parts I need in (say) Ada"
https://github.com/Componolit/libsparkcrypto might be of interest to some. It is written in Ada/SPARK.