Keep decoding, canonicalization and trust separate
05A readable block can still hold malformed, secret or untrusted data. Textual formatting is not a certificate check, a secure storage system or a canonical fingerprint format.
The application gate refuses to conclude trusted or encrypted from a readable wrapper. Trust needs appropriate validation; encryption needs an encrypted inner structure. No success assertion is issued merely because a label and Base64 parse.
Source for this drawing: RFC 7468 · Read RFC section 14 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Recover bytes first; then apply the structure and security checks appropriate to the use.
- RFC 7468 does not define canonical textual encodings. Different line endings, tolerated whitespace or accepted label aliases can represent the same underlying data. A hash of file text can therefore differ even when decoded bytes match.
- If a canonical object representation is needed, decode the textual wrapper and process the inner structure into DER. Appendix B is informative, and CMS can legitimately use indefinite-length BER for streaming; only particular signed/authenticated attributes need DER under the relevant CMS rules.
- Untrusted data requires safe parsing. A syntactically readable CERTIFICATE still requires the relevant certificate, signature, identity, time and trust-policy checks for its use. Successful Base64 decoding proves none of those.
- Base64 is reversible encoding. Protect unencrypted private-key material from disclosure; an ENCRYPTED PRIVATE KEY label must be backed by the proper encrypted structure and suitable cryptographic choices. This guide neither generates real keys nor implements certificate validation.
Do not fingerprint a casually reformatted text file as though it were a canonical object. No new MIME registration is asserted: reported erratum 7697 is not a verified replacement for §5.3.
Read the RFC section ↗