Holger Reif wrote:
>
> Dr Stephen Henson schrieb:
> >
> > One is to note the original encoding and then compare it with what we
> > think it should be. If they match then fair enough: we can discard the
> > original, if they don't match then the original encoding is retained for
> > signature verification.
> >
> > There are a few complications with this...
> >
> > Any other ideas anyone?
>
> Mhhh.... If you take the provision of *possible* keeping
> some original content and then *maybe* discard it...
> wouldn't it become more complex if necessary? Or
> do you have memory usage in mind?
>
I have the "complications" in mind :-)
Here's my thinking.
The main problem with caching encodings in OpenSSL is determining when
the cache is no longer valid: i.e. when the underlying structure has
changed. This is relatively easy if the underlying structure is always
modified in a documented API, just invalidate the cache when it is
changed.
When the API doesn't exist or is undocumented then an application might
well modify the underlying structure without calling any function (if it
exists) to do it.
One possible solution, albeit a messy one is this:
1. Initially store the received encoding.
2. Generate a version of the received encoding for the decoded structure
(i.e. what OpenSSL thinks the DER encoding should be).
3. If the two don't match then cache the received encoding and a hash of
the generated version. If they do match then discard the cached version.
The reason for this is to handle the case when we are asked to
regenerate the encoding and to handle a modified structure. This might
involve:
1. If the cache isn't present just use the generated version and exit.
2. If the cache is present then regenerate the encoding from the
structure and hash it.
3. If the hash of the generated version doesn't match the cached hash
then the underlying structure has changed: discard the cache, use the
generated version.
4. Otherwise use the cached version of the encoding.
Since all this is likely to be rather inefficient this is designed to
only use the cached version when we really need to. It also means that
the presence of the cached version can be used as an indicator that the
received encoding is broken.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
