如何解析 DER 字节？

Question

我正在尝试为 Elasticsearch Searchguard. One requirement is that the cert must include oid:1.2.3.4.5.5 in SANs. I am using GO to generate that cert. After some trial and error I have figured out that if I use []byte{0x88, 0x05, 0x2A, 0x03, 0x04, 0x05, 0x05} as Raw ASN.1 bytes, this turns into oid:1.2.3.4.5.5 in SANs . I want to understand how these bytes represent the value oid:1.2.3.4.5.5. I have read this 创建证书，但我仍然感到困惑。你能帮我理解这个 []byte 是如何表示 oid:1.2.3.4.5.5 的吗？

Answer 1

主要是欺骗How does ASN.1 encode an object identifier?

(X.509=PKIX) SAN 扩展值的编码在 rfc5280 中定义为：

SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE { // tags implicit
     otherName                 [0]  AnotherName,
     rfc822Name                [1]  IA5String,
     dNSName                   [2]  IA5String,
     x400Address               [3]  ORAddress,
     directoryName             [4]  Name,
     ediPartyName              [5]  EDIPartyName,
     uniformResourceIdentifier [6]  IA5String,
     iPAddress                 [7]  OCTET STRING,
     registeredID              [8]  OBJECT IDENTIFIER }

对于此 CHOICE，您的第一个八位字节 0x88 是上下文特定 #8 的标记值（表示已注册 ID），您的第二个八位字节 0x05 是值的长度，编码为 0x2A 0x03 0x04 0x05 0x05。由于这个值是一个对象标识符，要对其进行解码，请查看 Kaliski 文档中 OBJECT IDENTIFIER 下的编码部分：

BER encoding. Primitive. Contents octets are as follows, where value1, ..., valuen denote the integer values of the components in the complete object identifier:

The first octet has value 40 * value1 + value2. (This is unambiguous, since value1 is limited to values 0, 1, and 2; value2 is limited to the range 0 to 39 when value1 is 0 or 1; and, according to X.208, n is always at least 2.)

The following octets, if any, encode value3, ..., valuen. Each value is encoded base 128, most significant digit first, with as few digits as possible, and the most significant bit of each octet except the last in the value's encoding set to "1."

第一个值八位字节 0x2A 是十进制的 42 和 42 = 40 * 1 + 2，所以 OID 的前两个组件是 1 和 2。所有剩余的八位字节都没有设置它们的最高有效位所以它们各自编码一个组件：3 4 5 5。由组件 1 2 3 4 5 5 组成的 OID 采用通常的 shorthand 表示法 1.2.3.4.5.5（但还有其他等效表示法，如 Kaliski 所示） .

顺便说一下，那个 OID 是无效的，因为它必须在 ISO3166 数字代码为 3 的国家/地区的成员机构下，而没有这样的国家/地区。

如何解析 DER 字节？

How to parse DER bytes?

asn.1

go

search-guard