Problem - Kevin Tafuro

data ready to go into the certificate, you can use DER and the ASN.1 specification to
encode the data into an interoperable binary representation.
ASN.1 specifications of data objects can be quite complex. In particular, the specification
for X.509v3 is vast because X.509v3 is a highly versatile certificate format. If
you plan on reading and writing DER-encoded data on your own instead of using a
cryptographic library, we recommend using an ASN.1 “compiler” that can take an
ASN.1 specification as input and produce C data structures and routines that encode
and parse data in a DER-encoded format. The Enhanced SNACC ASN.1 compiler is
available under the GNU GPL from http://www.getronicsgov.com/hot/snacc_lib.htm.
If you need to do sophisticated work with certificates, you may want to look at the
freeware Certificate Management Library, available from http://www.getronicsgov.com/
hot/cml_home.htm. It handles most operations you can perform on X.509 certificates,
including retrieving certificates from LDAP databases.
Here, we’ll show you the OpenSSLAPIs for DER-encoding data objects and for converting
binary data into OpenSSLdata types. All of the functions in the OpenSSLAPI
either convert OpenSSL’s internal representation to a DER representation (the i2d
functions) or convert DER into the internal representation (the d2i functions).
The basic i2d functions output to memory and take two arguments: the object to
convert to DER and a buffer into which to write the result. The second argument is a
pointer to a buffer of unsigned characters, represented as unsigned char **. That is,
if you are outputting into an unsigned char *x, where x doesn’t actually hold the
string, but holds the address in memory where that string starts, you need to pass in
the address of x.
OpenSSLrequires you to pass in a pointer to a pointer because it takes
your actual pointer and “advances” it. We don’t like this feature and
have never found it useful. In general, you should copy over the
pointer to your buffer into a temporary variable, then send in the
address of the temporary variable.
Note that you need to know how big a buffer to pass in as the second parameter. To
figure that out, call the function with a NULL value as the second argument. That
causes the function to calculate and return the size.
For example, here’s how to DER-encode an RSA public key:
#include
/* Returns the malloc'd buffer, and puts the size of the buffer into the integer
* pointed to by the second argument.
*/
unsigned char *DER_encode_RSA_public(RSA *rsa, int *len) {
unsigned char *buf, *next;
*len = i2d_RSAPublicKey(rsa, 0);
Representing Public Keys and Certificates in Binary (DER Encoding) | 353
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.