* Posts by hlkii

2 publicly visible posts • joined 6 Aug 2009

IE, Chrome, Safari duped by bogus PayPal SSL cert

hlkii

It's Microsoft's fault because...

...some developer decided to use a C string operation (which is terminated by the appearance of the first 0x00 in the string) on an ASN.1 string data type. ASN.1 data structures are TLV (type, length, value). SInce the length of the string is specified in the encoding, the appearance of a null within the string shouldn't stop the processing of that string before its end is reached.

XML flaws threaten 'enormous' array of apps

hlkii

ASN.1 is not really a network standard but rather...

...a specification of a notation used to specify the data structures in a protocol. For example, it is used to specify the structure of the X.509 public-key digital certificate. The errors referenced in the article were in libraries containing the routines used to extract data from ASN.1 structures.