I suggest that I-D clarify that values which are BER encoded are BER encoded per RFC 2251, 5.1. Section 5.2 says: The criticality is FALSE (MAY be absent). If FALSE, it MUST be absent per RFC 2251, 5.1(4). Kurt