You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In computing, serialization is the process of translating a data structure or object state into a format that can be stored (for example, in a file or memory data buffer) or transmitted (for example, across a computer network) and reconstructed later (possibly in a different computer environment). When the resulting series of bits is reread according to the serialization format, it can be used to create a semantically identical clone of the original object. For many complex objects, such as those that make extensive use of references, this process is not straightforward. Serialization of object-oriented objects does not include any of their associated methods with which they were previously linked.
4
-
5
-
This process of serializing an object is also called marshalling an object in some situations.The opposite operation, extracting a data structure from a series of bytes, is de-serialization, (also called un-serialization or un-marshalling).
Several security-related standards used on the Internet define ASN.1
15
-
data formats that are normally encoded using the Basic Encoding Rules
16
-
(BER) or Distinguished Encoding Rules (DER) [X.690](https://en.wikipedia.org/wiki/X.690), which are
17
-
binary, octet-oriented encodings.
18
-
A disadvantage of a binary data format is that it cannot be
19
-
interchanged in textual transports, such as email or text documents.
20
-
One advantage with text-based encodings is that they are easy to
21
-
modify using common text editors; for example, a user may concatenate
22
-
several certificates to form a certificate chain with copy-and-paste
23
-
operations.
24
-
The content of a PEM file begins with a header such as `-----BEGIN CERTIFICATE-----` in a stand-alone line and ends with a
25
-
footer like `-----END CERTIFICATE-----` in the same way. The contents between header and footer tags are base64 encoded string of the related object in DER-encoded format. Except the header, the last line of content and footer lines, each line has the length of 64 characters. So, to parse a PEM file, you need to know the exact definition of the encoded object in ASN.1 syntax. you can use this online tool to check the content of a PEM file [PEM Parser](https://8gwifi.org/PemParserFunctions.jsp) or [Decode PEM data](https://report-uri.com/home/pem_decoder).
26
-
27
-
38
+
### PEM
39
+
40
+
[RFC 7468](https://tools.ietf.org/html/rfc7468)
41
+
42
+
Several security-related standards used on the Internet define [ASN.1](https://en.wikipedia.org/wiki/ASN.1) data formats
43
+
that are normally encoded using the Basic Encoding Rules (BER) or Distinguished Encoding Rules (
44
+
DER) [X.690](https://en.wikipedia.org/wiki/X.690), which are binary, octet-oriented encodings.
45
+
46
+
#### Advantage and disadvantage
47
+
48
+
A disadvantage of a binary data format is that it cannot be interchanged in textual transports, such as email or text
49
+
documents. One advantage with text-based encodings is that they are easy to modify using common text editors; for
50
+
example, a user may concatenate several certificates to form a certificate chain with copy-and-paste operations.
51
+
52
+
#### File content
53
+
54
+
The content of a PEM file begins with a header such as `-----BEGIN CERTIFICATE-----` in a stand-alone line and ends with
55
+
a footer like `-----END CERTIFICATE-----` in the same way. The contents between header and footer tags are base64
56
+
encoded string of the related object in DER-encoded format. Except the header, the last line of content and footer
57
+
lines, each line has the length of 64 characters. So, to parse a PEM file, you need to know the exact definition of the
58
+
encoded object in ASN.1 syntax. you can use this online tool to check the content of a PEM
or [Decode PEM data](https://report-uri.com/home/pem_decoder).
61
+
28
62
#### Public Key
29
63
30
-
a PEM file which contains a public key begins with the line `-----BEGIN PUBLIC KEY-----` and ends with the line `-----END PUBLIC KEY-----`. Between these two tags is the base64 encoded string of `SubjectPublicKeyInfo` object in DER-encoded format:
64
+
A PEM file which contains a public key begins with the line `-----BEGIN PUBLIC KEY-----` and ends with the
65
+
line `-----END PUBLIC KEY-----`. Between these two tags is the base64 encoded string of `SubjectPublicKeyInfo` object in
- parse the resulting byte array(`DER` formatted) according to the ASN.1 syntax of `SubjectPublicKeyInfo`[RFC5280](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.1.2):
89
+
- parse the resulting byte array(`DER` formatted) according to the ASN.1 syntax
90
+
of `SubjectPublicKeyInfo`[RFC5280](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.1.2):
you can use the [ASN.1 Javascript decoder](https://lapo.it/asn1js/) online tool to check the parser result :
104
+
you can use the [ASN.1 Javascript decoder](https://lapo.it/asn1js/) online tool to check the parser result:
67
105
68
106
```
69
107
SEQUENCE (2 elem)
@@ -73,25 +111,33 @@ SEQUENCE (2 elem)
73
111
BIT STRING (520 bit) 0000010010010011010110101010011100100101100101111110001110111011101100…
74
112
```
75
113
76
-
We know that the `SEQUENCE` tag is `0x30` so the byte array is started with this value. Here, `0x59` equals to the length of the `SEQUENCE` object in bytes. The next `0x30` means that there is another `SEQUENCE` as we expect from the `AlgorithmIdentifier` definition syntax. The `SubjectPublicKey` contains the public key bytes and included as a `BIT STRING` in the object. `BIT STRING` tag is `0x03` which you can find it in the byte array easily followed by `0x42`(it's length in bytes).
114
+
We know that the `SEQUENCE` tag is `0x30` so the byte array is started with this value. Here, `0x59` equals to the
115
+
length of the `SEQUENCE` object in bytes. The next `0x30` means that there is another `SEQUENCE` as we expect from
116
+
the `AlgorithmIdentifier` definition syntax. The `SubjectPublicKey` contains the public key bytes and included as
117
+
a `BIT STRING` in the object. `BIT STRING` tag is `0x03` which you can find it in the byte array easily followed
118
+
by `0x42`(it's length in bytes).
77
119
78
-
Sometimes, the cryptographic objects such as `Certificate`s, `Public Key`s, ... may be stored or transmitted in `DER` format (`.der`).
79
-
For example the following command will export the former public key (an EC Public Key) from `PEM` format to its equivalent `DER` one:
120
+
Sometimes, the cryptographic objects such as `Certificate`s, `Public Key`s, ... may be stored or transmitted in `DER`
121
+
format (`.der`). For example the following command will export the former public key (an EC Public Key) from `PEM`
The resulting `.der` file contains the base64 decoded of `.pem` file. Please note that the `OpenSSL` command for a `RSA Public Key` is as the following one:
128
+
The resulting `.der` file contains the base64 decoded of `.pem` file. Please note that the `OpenSSL` command for
@@ -102,19 +148,28 @@ Note: `Certificate` in `DER` format may be stored in `.der`, `.cer` or `.crt` fi
102
148
103
149
### [ASN.1](https://en.wikipedia.org/wiki/ASN.1)
104
150
105
-
Abstract Syntax Notation One (ASN.1) is a standard interface description language for defining data structures that can be serialized and deserialized in a cross-platform way. It is broadly used in telecommunications and computer networking, and especially in cryptography.
151
+
Abstract Syntax Notation One (ASN.1) is a standard interface description language for defining data structures that can
152
+
be serialized and deserialized in a cross-platform way. It is broadly used in telecommunications and computer
153
+
networking, and especially in cryptography.
106
154
107
-
Protocol developers define data structures in ASN.1 modules, which are generally a section of a broader standards document written in the ASN.1 language. The advantage is that the ASN.1 description of the data encoding is independent of a particular computer or programming language. Because ASN.1 is both human-readable and machine-readable, an ASN.1 compiler can compile modules into libraries of code, codecs, that decode or encode the data structures. Some ASN.1 compilers can produce code to encode or decode several encodings.
155
+
Protocol developers define data structures in ASN.1 modules, which are generally a section of a broader standards
156
+
document written in the ASN.1 language. The advantage is that the ASN.1 description of the data encoding is independent
157
+
of a particular computer or programming language. Because ASN.1 is both human-readable and machine-readable, an ASN.1
158
+
compiler can compile modules into libraries of code, codecs, that decode or encode the data structures. Some ASN.1
159
+
compilers can produce code to encode or decode several encodings.
108
160
109
161
[X.690](https://en.wikipedia.org/wiki/X.690) is an ITU-T standard specifying several ASN.1 encoding formats:
110
162
111
163
- Basic Encoding Rules (BER)
112
164
- Canonical Encoding Rules (CER)
113
165
- Distinguished Encoding Rules (DER)
114
166
115
-
Any ASN.1 encoding begins with two common bytes (or octets, groupings of eight bits) that are universally applied regardless of the type. The first byte is the type indicator, which also includes some modification bits we shall briefly touch upon. The second byte is the length header.
167
+
Any ASN.1 encoding begins with two common bytes (or octets, groupings of eight bits) that are universally applied
168
+
regardless of the type. The first byte is the type indicator, which also includes some modification bits we shall
169
+
briefly touch upon. The second byte is the length header.
116
170
117
-
We will use the [asn1parse](https://www.openssl.org/docs/manmaster/man1/openssl-asn1parse.html) command of `OpenSSL` with [ASN1_generate_nconf](https://www.openssl.org/docs/manmaster/man3/ASN1_generate_nconf.html) formatted file.
171
+
We will use the [asn1parse](https://www.openssl.org/docs/manmaster/man1/openssl-asn1parse.html) command of `OpenSSL`
172
+
with [ASN1_generate_nconf](https://www.openssl.org/docs/manmaster/man3/ASN1_generate_nconf.html) formatted file.
118
173
119
174
Some of the more applicable data types are:
120
175
@@ -142,22 +197,24 @@ Some of the more applicable data types are:
142
197
143
198
- SET, SET OF : Constructed, tag = 0x11
144
199
145
-
The header byte is always placed at the start of any ASN.1 encoding and is divides into three parts: the classification, the constructed bit, and the primitive type. The header byte is broken as shown here :
200
+
The header byte is always placed at the start of any ASN.1 encoding and is divides into three parts: the classification,
201
+
the constructed bit, and the primitive type. The header byte is broken as shown here :
146
202
147
203
- bits 8,7 : Classification
148
-
- bit 6 : Constructed
204
+
- bit 6 : Constructed
149
205
- bits 5..1 : Primitive Type
150
206
151
207
The classification bits refer to :
152
208
153
-
| Class| Bit 8| Bit 7 |
209
+
| Class | Bit 8| Bit 7 |
154
210
| :---------------| :-----| :-----|
155
-
|universal| 0| 0 |
156
-
|application| 0| 1 |
157
-
|context-specific | 1| 0 |
158
-
|private| 1| 1 |
211
+
|universal | 0| 0 |
212
+
|application | 0| 1 |
213
+
|context-specific | 1| 0 |
214
+
|private | 1| 1 |
159
215
160
-
`Primitive` method applies to simple types and types derived from simple types by implicit tagging. It requires that the length of the value be known in advance.
216
+
`Primitive` method applies to simple types and types derived from simple types by implicit tagging. It requires that the
217
+
length of the value be known in advance.
161
218
162
219
Simple Integer : put this lines as the content of `int.cnf` file:
Tagging is useful to distinguish types within an application; it is also commonly used to distinguish component types within a structured type. For instance, optional components of a SET or SEQUENCE type are typically given distinct context-specific tags to avoid ambiguity.
198
-
There are two ways to tag a type: implicitly and explicitly.
255
+
Tagging is useful to distinguish types within an application; it is also commonly used to distinguish component types
256
+
within a structured type. For instance, optional components of a SET or SEQUENCE type are typically given distinct
257
+
context-specific tags to avoid ambiguity. There are two ways to tag a type: implicitly and explicitly.
199
258
200
-
Implicitly tagged types are derived from other types by changing the tag of the underlying type.
259
+
Implicitly tagged types are derived from other types by changing the tag of the underlying type.
201
260
202
261
[[class] number] IMPLICIT Type
203
262
204
263
class = UNIVERSAL | APPLICATION | PRIVATE
205
264
206
-
where Type is a type, class is an optional class name, and number is the tag number within the class, a nonnegative integer.
207
-
If the class name is absent, then the tag is context-specific.
265
+
where Type is a type, class is an optional class name, and number is the tag number within the class, a nonnegative
266
+
integer. If the class name is absent, then the tag is context-specific.
PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm PrivateKeyAlgorithmIdentifier, privateKey PrivateKey,
299
+
attributes [0] IMPLICIT Attributes OPTIONAL }
242
300
243
-
Here the underlying type is Attributes, the class is absent (i.e., context-specific), and the tag number within the class is 0.
301
+
Here the underlying type is Attributes, the class is absent (i.e., context-specific), and the tag number within the
302
+
class is 0.
244
303
245
-
`Constructed, definite-length` method applies to simple string types, structured types, types derived simple string types and structured types by implicit tagging, and types derived from anything by explicit tagging. It requires that the length of the value be known in advance.
types and structured types by implicit tagging, and types derived from anything by explicit tagging. It requires that
306
+
the length of the value be known in advance.
246
307
247
-
For example a `SEQUENCE` will be shown by `0x30` tag, because it's a constructed type so the `6`th bit will be `1` and makes the `0x10` tag to `0x30`. The same approach cause that a `SET` will be started by `0x31`.
308
+
For example a `SEQUENCE` will be shown by `0x30` tag, because it's a constructed type so the `6`th bit will be `1` and
309
+
makes the `0x10` tag to `0x30`. The same approach cause that a `SET` will be started by `0x31`.
248
310
249
311
Explicit tagging denotes a type derived from another type by adding an outer tag to the underlying type.
250
312
251
313
[[`class`]`number`] EXPLICIT `Type`
252
314
253
315
`class` = UNIVERSAL | APPLICATION | PRIVATE
254
316
255
-
where `Type` is a type, `class` is an optional class name, and `number` is the tag number within the class, a nonnegative integer.
317
+
where `Type` is a type, `class` is an optional class name, and `number` is the tag number within the class, a
318
+
nonnegative integer.
256
319
257
320
If the `class` name is absent, then the tag is `context-specific`.
0 commit comments