DER SET ordering: enforce it in the walk, not in a check afterwards
A SET in ASN.1 is unordered by definition: the arrangement of its components carries no meaning. DER still fixes exactly one arrangement on the wire, ascending by encoding, compared as octet strings. A parser that accepts any other arrangement has made many byte strings decode to one value, and only one of those byte strings was ever signed. That is the whole problem in one sentence. The rest of…
The rule of DER SET ordering is crucial because it enforces a specific arrangement of components within a SET structure, which carries no inherent meaning. While a parser may accept various arrangements, only one specific byte string was ever signed, making any deviation problematic. DER readers like derstrict enforce this rule during the walk over a SET's children, refusing any non-compliant encodings.
This placement is crucial because it ensures that the parsed value remains consistent with the signed byte string, preventing discrepancies that could lead to verification failures. Ordering is an encoding property, not a cosmetic one, as signature verification is performed on the byte level and does not consider alternative interpretations.
A lenient reader can introduce ambiguity, resulting in different implementations interpreting the same signed document differently. The enforcement of SET ordering during the walk over a SET's children is more effective than a post-pass, as it maintains the integrity of the original signed document.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
