Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use pyasn1-fasder for ASN.1 DER decoding #98

Merged
merged 6 commits into from
Aug 28, 2024
Merged

Use pyasn1-fasder for ASN.1 DER decoding #98

merged 6 commits into from
Aug 28, 2024

Conversation

CBonnell
Copy link
Collaborator

@CBonnell CBonnell commented Aug 28, 2024

pyasn1-fasder is an alternative ASN.1 DER decoding library for pyasn1. Switching to use this library has three benefits over using the default DER decoder:

  1. It detects more DER encoding errors than the default pyasn1 DER decoder, obviating the need for additional validators to check ASN.1 syntax (PrintableString alphabet constraints, etc.). Given this, the "decode, re-encode, and compare binary" step currently done by pkilint can be removed.
  2. Written in Rust, it is roughly twice as fast as the default pyasn1 decoder. Performance testing indicates that linting is 30-40% faster using pyasn1-fasder.
  3. ASN.1 items that can be encoded multiple ways per the schema will no longer result in an incorrect DER encoding error (resolves DER decode error occurs when loading CRLs with explicitly encoded empty revoked certificate SEQUENCE #66).

@CBonnell CBonnell merged commit 5076b96 into main Aug 28, 2024
8 checks passed
@CBonnell CBonnell deleted the fasder branch August 28, 2024 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

DER decode error occurs when loading CRLs with explicitly encoded empty revoked certificate SEQUENCE
1 participant