4 ms·

ASN.1 is an awesome way of encoding information, but having variable lengths all over - implementations are very prone to bugs and buffer overflows. It sure wa

by dkopi 12y ago

ASN.1 is an awesome way of encoding information, but having variable lengths all over - implementations are very prone to bugs and buffer overflows. It sure was fun implementing back then.

userbinator 12y ago
At some point you will have to deal with items of varying length, and what ASN.1 does is IMHO far better than some of the other protocols. In particular, DER is all TLV, so the lengths are explicitly provided a priori and can be checked easily. Contrast this with text-based protocols that rely on scanning forward to find a delimiter - the lengths are implicit. I think this is what really can cause bugs, as not having explicit lengths makes it easier to forget to check them against the buffer's size.
- noblethrasher 12y ago
  On the other hand, there is some research[1][2] which indicates that one way of improving software security and reliability is to (1) realize that any program that accepts input is basically a recognizer of strings belonging to some formal language, and (2) that we should limit the grammar of said language to regular or, at most, context-free. Length fields automatically make the grammar context sensitive which is much harder to secure according to langsec. [1] http://langsec.org/ http://langsec.org/ [2] http://youtu.be/UzjfeFJJseU http://youtu.be/UzjfeFJJseU
  - pmahoney 12y ago
    Interesting link, just skimmed it and haven't had a chance to watch the video. > Length fields automatically make the grammar context sensitive which is much harder to secure according to langsec. Is this accurate given a finite length field? I can imagine a DFA that recognizes the language of a single byte length prefix followed by strings of 1 to 255 characters, just that the node that consumes the length field will have 255 branches to sub-DFAs that recognize 1, 2, ..., 255 character strings.
    - noblethrasher 12y ago
      Yes, I should have said “unbounded length field”. But, with respect to the discussion, a 32 or 64-bit integer is only bounded in the academic sense. Also, here is a video that works a bit better as an introduction to LANGSEC: https://www.youtube.com/watch?v=3kEfedtQVOY https://www.youtube.com/watch?v=3kEfedtQVOY (around 19:00 is especially entertaining)
    - _delirium 12y ago
      That's the tricky bit with the formal language hierarchy: it collapses when you add restrictions to finite quantities. For example, a context-free language with productions limited to a finite recursion depth is a regular language.

by dkopi 12y ago

ASN.1 is an awesome way of encoding information, but having variable lengths all over - implementations are very prone to bugs and buffer overflows. It sure was fun implementing back then.

userbinator 12y ago

At some point you will have to deal with items of varying length, and what ASN.1 does is IMHO far better than some of the other protocols. In particular, DER is all TLV, so the lengths are explicitly provided a priori and can be checked easily. Contrast this with text-based protocols that rely on scanning forward to find a delimiter - the lengths are implicit. I think this is what really can cause bugs, as not having explicit lengths makes it easier to forget to check them against the buffer's size.

noblethrasher 12y ago
On the other hand, there is some research[1][2] which indicates that one way of improving software security and reliability is to (1) realize that any program that accepts input is basically a recognizer of strings belonging to some formal language, and (2) that we should limit the grammar of said language to regular or, at most, context-free. Length fields automatically make the grammar context sensitive which is much harder to secure according to langsec. [1] http://langsec.org/ http://langsec.org/ [2] http://youtu.be/UzjfeFJJseU http://youtu.be/UzjfeFJJseU
- pmahoney 12y ago
  Interesting link, just skimmed it and haven't had a chance to watch the video. > Length fields automatically make the grammar context sensitive which is much harder to secure according to langsec. Is this accurate given a finite length field? I can imagine a DFA that recognizes the language of a single byte length prefix followed by strings of 1 to 255 characters, just that the node that consumes the length field will have 255 branches to sub-DFAs that recognize 1, 2, ..., 255 character strings.
  - noblethrasher 12y ago
    Yes, I should have said “unbounded length field”. But, with respect to the discussion, a 32 or 64-bit integer is only bounded in the academic sense. Also, here is a video that works a bit better as an introduction to LANGSEC: https://www.youtube.com/watch?v=3kEfedtQVOY https://www.youtube.com/watch?v=3kEfedtQVOY (around 19:00 is especially entertaining)
  - _delirium 12y ago
    That's the tricky bit with the formal language hierarchy: it collapses when you add restrictions to finite quantities. For example, a context-free language with productions limited to a finite recursion depth is a regular language.