An Empirical Study of Vulnerabilities in Cryptographic Libraries

Re:An Empirical Study of Vulnerabilities in Cryptographic Li... by memling on Sunday July 25, 2021 @01:25PM (#27951065)

> I tried OSS NOKALVA's ASN.1 for Java but constraint checking is non-existent or very limited.

A quick look at their documentation suggests the use of the -constraints option.[1] Constraints are such a basic part of the ASN.1 specifications I can't imagine any vendor not implementing it. I know for a fact that Objective Systems' compiler does.[2]

[1]: https://www.oss.com/asn1/products/documentation/asn1_java_8....

[2]: https://www.obj-sys.com/products/asn1c/index.php

[ Parent | on HN ]

Re:An Empirical Study of Vulnerabilities in Cryptographic Li... by johnisgood on Sunday July 25, 2021 @05:39PM (#27953158)

Thank you, I think I missed `-constraints`, then! I will give it a go and check out the generated file. I expected it to be turned on automatically. My bad! That said, I will check if it does the constraint checking properly. I hope it does!

I know, Erlang's ASN.1 compiler does it too, automatically. It is pretty awesome.

---

Update: `-constraints` does work (`validConstraint = temp1 >= 10 && temp1 <= 20`)

I will try out more complex ones. :)

[ Parent | on HN ]