We've identified ~some~ of OpenSSL's strange behaviors and documented them for the purpose of making a bug compatible implementation (https://github.com/bitcoin

We've identified ~some~ of OpenSSL's strange behaviors and documented them for the purpose of making a bug compatible implementation (https://github.com/bitcoin-core/secp256k1/tree/master/contrib https://github.com/bitcoin-core/secp256k1/tree/master/contri...), which required that: - All numbers are parsed as nonnegative integers, even though X.609-0207 section 8.3.3 specifies that integers are always encoded as two's complement. - Integers can have length 0, even though section 8.3.1 says they can't. - Integers with overly long padding are accepted, violation section 8.3.2. - 127-byte long length descriptors are accepted, even though section 8.1.3.5.c says that they are not. - Trailing garbage data inside or after the signature is ignored. - The length descriptor of the sequence is ignored. But some things were just too awful to implement, e.g. - Using overly long tag descriptors for the sequence or integers inside, violating section 8.1.2.2. - Encoding primitive integers as constructed values, violating section 8.3.1. This last is especially fun, in OpenSSL you can create a constructed value (like a struct) of constructed values of constructed values of strings.. and it will just concatenate up all the bytes in the last level primitive elements and treat the result as a number. ... but only if it's not more than 7 (IIRC) levels deep.