Not using ASN.1 is a massive improvement. ASN.1 is turing complete. That means you cannot computationally decide if two certificates are equivilent, assuming advanced enough fuckery.
This is very very bad.
ASN.1 (which is also used in x509) is a catastrophicly awful format for encoding certificates or other crypto operations, and is the direct cause of a huge amount of SSL/TLS security issues.
ASN.1 is a horror show, and the actual implementations of it that are available are even worse-- I've still yet to find an open source implementation of BER that strictly matches the spec, correctly accepting and interpreting all values that should be accepted and rejecting all values that should not... but I believe that you're joking about "turing complete".
... But ASN.1 is so bad that I'm not completely sure. Can you confirm or cite?
ASN.1 as used by Internet PKIX X.509 uses [1] a form known as DER (Distinguished Encoding Rules) which provide a canonical way encoding any particular value such that any particular value can take only one specific form.
This is very very bad.
ASN.1 (which is also used in x509) is a catastrophicly awful format for encoding certificates or other crypto operations, and is the direct cause of a huge amount of SSL/TLS security issues.