ASN.1
Abstract Syntax Notation #1

Typ
- zacina velkym pismenem
- 4 druhy
   1. jednoduchy
   2. strukturovany {}, oddelovac carka
   3. odvozeny  
   4. jiny  ANY CHOISE

Version::=INTEGER
Pohlavi::=INTEGER

Student::=STRUCTURE OF {
  jmeno IA5String,
  prijmeni IA5String,
  pohlavi Pohlavi,
...
}

kodovani
X.209  Basic Encoding Rules

typ tag
BOOLEAN 1
INTEGER 2
BIT STRING 3
OCTET STREAM 4
NULL 5
OBJECT IDENTIFIER 6
REAL 9
ENUMERATED 10
SEQUENCE, SEQUENCE OF 16
SET, SET OF 17
PrintableString 19  (A-Z, 0-9, space a-z, '()+,-./:=? )
T61String 20
IA5String 22
UTCTime 23  (20060323082133.5-0100)
VisibleString 26

typ dat | delka | hodnota

typ dat
0-31
   trida (7-6, 00 univerzalni tag
       01 aplikacni tag
       10  contextove specificky tag
       11 privatni tag  )
   jednoduchy/strukturovany typ (5. bit,  0/1)
   tag

vetsi
  31  a nasleduji byty 0x80+7bitu pro id tagu, posledni 0x00+7bitu

delka
  0x00 + 7bitu delky (0-127)
  0x80 + 7 bitu poctu nasledujicich bytu s delkou

INTEGER 0x1234
02|02|12|34

INTEGER 128 0x0080
02|02|00|80

INTEGER 127
0       |02|01|00
1       |02|01|01
127   |02|01|7f
128   |02|02|00|80        |02|04|00|00|00|80
256   |02|02|01|00
-128  |02|01|80            |02|03|FF|FF|80
-129  |02|02|FF|7F       |02|03|FF|FF|7F

-129      FF7F, FFFFFFFFFFFFFF7F
-128      80, FFFFFFFFFFFFFF80, FF80
-2          fe
-1          FFFFFFFFFFFFFFff
0           00
1           01
127       7f
128       0080
129       0081

Distinguished Encoding Rules
   'normalizace' - zkraceni do minimalniho tvaru

UTCTime 23  (20060323082133.5-0100)
RRRRMMDDhhmm[ss]Z
RRRRMMDDhhmm[ss]+hhmm
RRRRMMDDhhmm[ss]-hhmm

200603230821Z
17|0D|32|30|30|36|30|33|32|33|30|38|32|31|5A

Student::=SEQUENCE OF {
  jmeno IA5String,
  prijmeni IA5String,
  pohlavi Pohlavi,
...
}
Jan Novak muz (1)

16   10h
    20h strukturovany typ

30|0F|        struktura
16|03| | | |      Jan
16|05| | | | | |      Novak
02|01|01|    muz

 

Identifikator

Identifikace objektů
 - stromova struktura
 - registracni urady ITU (drive CCITT) a ISO

*
 -ccitt(0) 
  -- recomendation(0)
  -- question(1)
  -- administration(2)
  -- network operator(3)
 - iso(1)
  -- standard(0)
  -- registration authority(1)
  -- member body(2)
  -- identified organization(?)
   ---dod(6)
    ----internet(1)
     -----directory(1)
     -----mgmt(2)
      ------mib(1)
     -----experimental(3)
     -----private(4)
      ------enterprises(1)
   --- ...
  -- ...
 - joint-iso-ccitt(2)

iso(1).identified organization(?).dod(6).internet(1).mgmt(2).mib(1)
1.?.6.1.2.1

Typ CHOICE

Certificate
ExtendedCertificate 

ExtendedCertificateOrCertificate ::= CHOICE {
  certificate Certificate,
  extendedCertificate [0] IMPLICIT ExtendedCertificate
} 

Typ ANY
AlgorithmIdentifier ::= SEQUENCE {
  algorithm OBJECT_IDENTIFIER,
  parameters ANY DEFINED BY algorithm OPTIONAL
}
  
openssl asn1parse –dump –in MYFILE –inform PEM
# nebo format DER

Certifikát
 - datová struktura obsahující údaje o uživateli
 - mj. veřejný klíč
 - je podepsaná vydavatelem

Version ::= INTEGER;    0 1 2
SerialNumber ::= INTEGER
AlgorithmIdentifier
Validity ::= SEQUENCE {
  notBefore UTCTime,
  notAfter UTCTime
}
SubjectPublicKeyInfo ::= {
  algorithm AlgorithmIdentifier,
  subjectPublicKey BIT_STRING
}

SIGNED_SEQUENCE ::= SEQUENCE {
  coMaBytPodepsano OCTEDSTRING,
  identifikatorAlgoritmu AlgorithmIdentifier,
  podpis OCTEDSTRING
}
Name

Name ::= SEQUENCE OF RelativeDistinguishedName

RelativeDistinguishedName ::= SET OF AttributeValueAssertion

AttributeValueAssertion ::= SEQUENCE { 
  attributeType AttributeType,
  attributeValue AttributeValue
}

AttributeType ::= OBJECT_IDENTIFIER
AttributeValue ::= ANY

C Country
O Organization
OU Organizational unit
CN Common Name
DN Distinguished Name, Domain Name
Email  Email address
serialNumber -"-

Rozsirene certifikaty - pridani dalsich vlastnosti
Omezeni pusobnosti klice
keyUsage OBJECT_IDENTIFICATOR ::= {joint-iso-ccitt(2).ds(5).id-ce(29).15}
KeyUsage ::= BIT_STRING {
  digitalSignature( 0),
  nonRepudation( 1),
  keyEncypherment( 2),
  dataEncypherment( 3),
  keyAgreement( 4),
  keyCertSign( 5),
  crlSign( 6)
}

Omezeni delky zretezeni certifikatu
identifikator
basicConstraints OBJECT_IDENTIFICATOR ::= {joint-iso-ccitt(2).ds(5).id-ce(29).19}
hodnota
BasicConstraints ::= SEQUENCE {
  cA BOOLEAN DEFAULT FALSE
  pathLenConstraints INTEGER OPTIONAL
}

odkaz na CRL
Certificate Revocation List

CRL - X.511
CRL ::= SIGNED SEQUENCE {
  signature AlgorithmIdentifier,
  issuer Name,
  lastUpdate UTCTime,
  nextUpdate UTCTime,
  revocedCertificates  SIGNED SEQUENCE OF SEQUENCE {
    //?? signature AlgorithmIdentifier,
    //?? issuer Name,
    userCertificates SerialNumber,
    revocationDate UTCTime OPTIONAL
  }
}