Package: asn1crypto
asn1cryptoA fast, pure Python library for parsing and serializing ASN.1 structures.FeaturesWhy Another Python ASN.1 Library?Related Crypto LibrariesCurrent ReleaseDependenciesInstallationLicenseSecurity PolicyDocumentationContinuous IntegrationTestingDevelopmentCI TasksFeaturesIn addition to an ASN.1 BER/DER decoder and DER serializer, the project includes
a bunch of ASN.1 structures for use with various common cryptography standards:StandardModuleSourceX.509asn1crypto.x509RFC 5280CRLasn1crypto.crlRFC 5280CSRasn1crypto.csrRFC 2986,RFC 2985OCSPasn1crypto.ocspRFC 6960PKCS#12asn1crypto.pkcs12RFC 7292PKCS#8asn1crypto.keysRFC 5208PKCS#1 v2.1 (RSA keys)asn1crypto.keysRFC 3447DSA keysasn1crypto.keysRFC 3279Elliptic curve keysasn1crypto.keysSECG SEC1 V2PKCS#3 v1.4asn1crypto.algosPKCS#3 v1.4PKCS#5 v2.1asn1crypto.algosPKCS#5 v2.1CMS (and PKCS#7)asn1crypto.cmsRFC 5652,RFC 2315TSPasn1crypto.tspRFC 3161PDF signaturesasn1crypto.pdfPDF 1.7Why Another Python ASN.1 Library?Python has long had thepyasn1andpyasn1_modulesavailable for
parsing and serializing ASN.1 structures. While the project does include a
comprehensive set of tools for parsing and serializing, the performance of the
library can be very poor, especially when dealing with bit fields and parsing
large structures such as CRLs.After spending extensive time usingpyasn1, the following issues were
identified:Poor performanceVerbose, non-pythonic APIOut-dated and incomplete definitions inpyasn1-modulesNo simple way to map data to native Python data structuresNo mechanism for overridden universal ASN.1 typesThepyasn1API is largely method driven, and uses extensive configuration
objects and lowerCamelCase names. There were no consistent options for
converting types of native Python data structures. Since the project supports
out-dated versions of Python, many newer language features are unavailable
for use.Time was spent trying to profile issues with the performance, however the
architecture made it hard to pin down the primary source of the poor
performance. Attempts were made to improve performance by utilizing unreleased
patches and delaying parsing using theAnytype. Even with such changes, the
performance was still unacceptably slow.Finally, a number of structures in the cryptographic space use universal data
types such asBitStringandOctetString, but interpret the data as other
types. For instance, signatures are really byte strings, but are encoded asBitString. Elliptic curve keys use bothBitStringandOctetStringto
represent integers. Parsing these structures as the base universal types and
then re-interpreting them wastes computation.asn1cryptouses the following techniques to improve performance, especially
when extracting one or two fields from large, complex structures:Delayed parsing of byte string valuesPersistence of original ASN.1 encoded data until a value is changedLazy loading of child fieldsUtilization of high-level Python stdlib modulesWhile there is no extensive performance test suite, theCRLTests.test_parse_crltest case was used to parse a 21MB CRL file on a
late 2013 rMBP.asn1cryptoparsed the certificate serial numbers in just
under 8 seconds. Withpyasn1, using definitions frompyasn1-modules, the
same parsing took over 4,100 seconds.For smaller structures the performance difference can range from a few times
faster to an order of magnitude or more.Related Crypto Librariesasn1cryptois part of the modularcrypto family of Python packages:asn1cryptooscryptocsrbuildercertbuildercrlbuilderocspbuildercertvalidatorCurrent Release1.5.0 -changelogDependenciesPython 2.6, 2.7, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10 or pypy.No third-party
packages required.Installationpipinstallasn1cryptoLicenseasn1cryptois licensed under the terms of the MIT license. See theLICENSEfile for the exact license text.Security PolicyThe security policies for this project are covered inSECURITY.md.DocumentationThe documentation forasn1cryptois composed of tutorials on basic usage and
links to the source for the various pre-defined type classes.TutorialsUniversal Types with BER/DER Decoder and DER EncoderPEM Encoder and DecoderReferenceUniversal types,asn1crypto.coreDigest, HMAC, signed digest and encryption algorithms,asn1crypto.algosPrivate and public keys,asn1crypto.keysX509 certificates,asn1crypto.x509Certificate revocation lists (CRLs),asn1crypto.crlOnline certificate status protocol (OCSP),asn1crypto.ocspCertificate signing requests (CSRs),asn1crypto.csrPrivate key/certificate containers (PKCS#12),asn1crypto.pkcs12Cryptographic message syntax (CMS, PKCS#7),asn1crypto.cmsTime stamp protocol (TSP),asn1crypto.tspPDF signatures,asn1crypto.pdfContinuous IntegrationVarious combinations of platforms and versions of Python are tested via:macOS, Linux, Windowsvia GitHub Actionsarm64via CircleCITestingTests are written usingunittestand require no third-party packages.Depending on what type of source is available for the package, the following
commands can be used to run the test suite.Git RepositoryWhen working within a Git working copy, or an archive of the Git repository,
the full test suite is run via:pythonrun.pytestsTo run only some tests, pass a regular expression as a parameter totests.pythonrun.pytestsocspPyPi Source DistributionWhen working within an extracted source distribution (aka.tar.gz) from
PyPi, the full test suite is run via:pythonsetup.pytestPackageWhen the package has been installed via pip (or another method), the packageasn1crypto_testsmay be installed and invoked to run the full test suite:pipinstallasn1crypto_tests
python-masn1crypto_testsDevelopmentTo install the package used for linting, execute:pipinstall--user-rrequires/lintThe following command will run the linter:pythonrun.pylintSupport for code coverage can be installed via:pipinstall--user-rrequires/coverageCoverage is measured by running:pythonrun.pycoverageTo change the version number of the package, run:pythonrun.pyversion{pep440_version}To install the necessary packages for releasing a new version on PyPI, run:pipinstall--user-rrequires/releaseReleases are created by:Making a git tag inPEP 440formatRunning the command:pythonrun.pyreleaseExisting releases can be found athttps://pypi.org/project/asn1crypto/.CI TasksA task nameddepsexists to download and stage all necessary testing
dependencies. On posix platforms,curlis used for downloads and on Windows
PowerShell withNet.WebClientis used. This configuration sidesteps issues
related to getting pip to work properly and messing withsite-packagesfor
the version of Python being used.Thecitask runslint(if flake8 is available for the version of Python) andcoverage(ortestsif coverage is not available for the version of Python).
If the current directory is a clean git working copy, the coverage data is
submitted to codecov.io.pythonrun.pydeps
pythonrun.pyci