入门指南：ASN.1 BER与DER详解

需积分: 9 187 浏览量更新于2024-07-20 收藏 133KB PDF 举报

本文档是一份面向非专业人士的ASN.1、BER（基本编码规则）和DER（区分编码规则）指南，由RSA Laboratories发布。它修订于1993年11月，替代了1991年的版本，后者曾作为NIST/OSI Implementors' Workshop文档SEC-SIG-91-17的一部分。PKCS（公共密钥加密标准）系列文档可通过电子邮件获取。该文档的版权属于RSA Data Security, Inc.，并允许在提及或引用此文档时注明“RSA Data Security, Inc. 公共密钥密码学标准（PKCS）”。 ASN.1（对象标识符体系）是开放系统互连（OSI）体系结构中的一个关键组成部分，它定义了数据的抽象语法和编码方式，用于网络通信中的数据交换。本文重点介绍了两种编码规则：BER和DER。BER是通用的、可变长的编码方法，适合在网络中传输不固定长度的数据，而DER则提供了固定的、最小化大小的编码，适用于需要确定性编码的场景。 1. 引言抽象化是软件开发中的一种普遍设计原则，它允许设计师专注于系统的一部分，无需过多考虑其实现细节。在ASN.1中，通过抽象语法，设计者可以定义一种数据结构，而不必关心如何在不同的平台上实际编码和解码这些结构。BER和DER的了解对于理解并实现PKCS标准至关重要，因为这些标准依赖于这两种编码方式来保证数据的安全性和一致性。 2. 基本编码规则（BER） BER（Basic Encoding Rules）是一种基于位流的编码方式，允许在序列化数据时使用变长编码。它采用的是递归结构，允许包含不同类型的数据，如整数、字符串、结构体和枚举。BER通过使用标记和长度来表示数据的类型和长度，这对于不固定长度的数据非常有用，因为它可以根据需要动态调整编码长度。 3. 区分编码规则（DER）相比之下，DER（Distinguished Encoding Rules）提供了一种更紧凑、确定性的编码方式。它强制要求每个编码都必须是最小化的形式，即去除所有可能的冗余。这使得DER编码的长度固定，对于需要确保数据完整性和互操作性的场景特别适用，例如数字证书和X.509公钥基础设施（PKI）中的证书。 4. PKCS应用 PKCS标准家族利用了ASN.1和BER/DER的基础，为加密、签名、证书管理和消息交换等任务提供了一套标准化的协议和格式。理解这些编码规则有助于开发者正确地创建、解析和验证PKCS文档，比如PKCS #1（公钥编码和签名算法规范）、PKCS #7（邮件安全）和PKCS #10（证书请求）等。总结来说，本文档为初学者提供了一个简明的入门教程，涵盖了ASN.1的子集以及BER和DER的使用，目的是为了支持对PKCS标准的实施和理解。无论是开发人员、测试工程师还是系统管理员，理解这些基础知识都是在安全通信领域取得成功的关键。

The keyword [class number] alone is the same as explicit tagging, except when the "module" in which the

ASN.1 type is defined has implicit tagging by default. ("Modules" are among the advanced features not

described in this note.)

For purposes of encoding, an implicitly tagged type is considered the same as the underlying type, except

that the tag is different. An explicitly tagged type is considered like a structured type with one component,

the underlying type. Implicit tags result in shorter encodings, but explicit tags may be necessary to avoid

ambiguity if the tag of the underlying type is indeterminate (e.g., the underlying type is CHOICE or ANY).

2.4 Other types

Other types in ASN.1 include the CHOICE and ANY types. The CHOICE type denotes a union of one or more

alternatives; the ANY type denotes an arbitrary value of an arbitrary type, where the arbitrary type is

possibly defined in the registration of an object identifier or integer value.

3. Basic Encoding Rules

The Basic Encoding Rules for ASN.1, abbreviated BER, give one or more ways to represent any ASN.1

value as an octet string. (There are certainly other ways to represent ASN.1 values, but BER is the

standard for interchanging such values in OSI.)

There are three methods to encode an ASN.1 value under BER, the choice of which depends on the type of

value and whether the length of the value is known. The three methods are primitive, definite-length

encoding; constructed, definite- length encoding; and constructed, indefinite-length encoding. Simple

non-string types employ the primitive, definite-length method; structured types employ either of the

constructed methods; and simple string types employ any of the methods, depending on whether the length

of the value is known. Types derived by implicit tagging employ the method of the underlying type and

types derived by explicit tagging employ the constructed methods.

In each method, the BER encoding has three or four parts:

Identifier octets. These identify the class and tag number of the ASN.1 value, and indicate

whether the method is primitive or constructed.

Length octets. For the definite-length methods, these give the number of contents octets. For

the constructed, indefinite-length method, these indicate that the length is indefinite.

Contents octets. For the primitive, definite-length method, these give a concrete

representation of the value. For the constructed methods, these give the concatenation of the

BER encodings of the components of the value.

End-of-contents octets. For the constructed, indefinite- length method, these denote the end of

the contents. For the other methods, these are absent.

The three methods of encoding are described in the following sections.

3.1 Primitive, definite-length method

This method applies to simple types and types derived from simple types by implicit tagging. It requires

that the length of the value be known in advance. The parts of the BER encoding are as follows:

Identifier octets. There are two forms: low tag number (for tag numbers between 0 and 30) and high tag

A Layman's Guide to a Subset of ASN.1, BER, and DER http://luca.ntop.org/Teaching/Appunti/asn1.html

5 of 26 2015/7/23 9:09

number (for tag numbers 31 and greater).

Low-tag-number form. One octet. Bits 8 and 7 specify the class (see Table 2), bit 6 has value

"0," indicating that the encoding is primitive, and bits 5-1 give the tag number.

Class Bit 8 Bit 7

universal 0 0

application 0 1

context-specific 1 0

private 1 1

Table 2. Class encoding in identifier octets.

High-tag-number form. Two or more octets. First octet is as in low-tag-number form, except

that bits 5-1 all have value "1." Second and following octets give the tag number, base 128,

most significant digit first, with as few digits as possible, and with the bit 8 of each octet

except the last set to "1."

Length octets. There are two forms: short (for lengths between 0 and 127), and long definite (for lengths

between 0 and 2^1008 -1).

Short form. One octet. Bit 8 has value "0" and bits 7-1 give the length.

Long form. Two to 127 octets. Bit 8 of first octet has value "1" and bits 7-1 give the number

of additional length octets. Second and following octets give the length, base 256, most

significant digit first.

Contents octets. These give a concrete representation of the value (or the value of the underlying type, if

the type is derived by implicit tagging). Details for particular types are given in Section 5.

3.2 Constructed, definite-length method

This method applies to simple string types, structured types, types derived simple string types and

structured types by implicit tagging, and types derived from anything by explicit tagging. It requires that

the length of the value be known in advance. The parts of the BER encoding are as follows:

Identifier octets. As described in Section 3.1, except that bit 6 has value "1," indicating that the encoding

is constructed.

Length octets. As described in Section 3.1.

Contents octets. The concatenation of the BER encodings of the components of the value:

For simple string types and types derived from them by implicit tagging, the

concatenation of the BER encodings of consecutive substrings of the value (underlying

value for implicit tagging).

For structured types and types derived from them by implicit tagging, the concatenation

of the BER encodings of components of the value (underlying value for implicit

tagging).

A Layman's Guide to a Subset of ASN.1, BER, and DER http://luca.ntop.org/Teaching/Appunti/asn1.html

6 of 26 2015/7/23 9:09

剩余25页未读，继续阅读

stzhu

粉丝: 0
资源: 1

入门指南：ASN.1 BER与DER详解

snmp asn.1

通俗解析ASN.1 BER与DER基础

Layman.js:node.js 中 HTTP 请求 <--> 响应层的简单管理器

laymansguide：新闻通讯库“ Layman's Guide to Computing”

asn1 layman

H264 primer - A layman’s guide - by KUSH AMERASINGHE

A Laymans Guide to a Subset of ASN 1 BER and DER

layman-开源

asn1:支持不定长度和64位整数的node-asn1的前叉

layman:外行的简单3D引擎

最新资源