X.690 is an ITU-T standard specifying several ASN.1 encoding formats:
Basic Encoding Rules (BER) Canonical Encoding Rules (CER) Distinguished Encoding Rules (DER) The Basic Encoding Rules (BER) were the original rules laid out by the ASN.1 standard for encoding data into a binary format. The rules, collectively referred to as a transfer syntax in ASN.1 parlance, specify the exact octets (8-bit bytes) used to encode data. X.680 defines a syntax for declaring data types, for example: Booleans, numbers, strings, and compound structures. Each type definition also includes an identifying number. X.680 defines several primitive data types, for example: BooleanType, IntegerType, OctetStringType. (ASN.1 also provides for constructed types built from other types.) Types are associated with a class. For example, the primitive types are part of the universal class. The three other classes (application, private, and context-specific) are essentially different scopes to support customization for specific applications. Combined, the class and type form a tag, which therefore corresponds to a unique data definition. X.690 includes rules for encoding those tags, data values (content), and the lengths of that encoded data. BER, along with two subsets of BER (the Canonical Encoding Rules and the Distinguished Encoding Rules), are defined by the ITU-T's X.690 standards document, which is part of the ASN.1 document series.
BER encoding Basic Encoding Rules specifies in general terms, a partially self-describing and self-delimiting protocol for encoding ASN.1 data structures. Each data element is to be encoded as a type identifier, a length description, the actual data elements, and, where necessary, an end-of-content marker. These types of encodings are commonly called type–length–value (TLV) encodings. However, in BER's terminology, it is identifier-length-contents. This type of format would allow a receiver to decode the ASN.1 information from an incomplete stream, without requiring any pre-knowledge of the size, content, or semantic meaning of the data, though some specifics of the protocol would need to be provided or reverse-engineered from representative samples of traffic or software. Data encoding consists of three or four components, in the following order:
Note that if a Length is zero, then there are no Contents octets, e.g. the NULL type. The End-of-Contents octets are only used for the indefinite form of Length.
Identifier octets The BER identifier octets encode the ASN.1 tags. The list of Universal Class tags can be found at Rec. ITU-T X.680, clause 8, table 1. The following tags are native to ASN.1:
Encoding The identifier octets encode the ASN.1 tag's class number and type number. It also encodes whether the contents octets represent a constructed or primitive value. The Identifier spans one or more octets.
In the initial octet, bit 6 encodes whether the type is primitive or constructed, bit 7–8 encode the tag's class, and bits 1–5 encode the tag's type. The following values are possible:
If the tag's type fits in the 5-bits (0-3010), then the Identifier spans just one byte: Short Form. If the tag's type is too large for the 5-bit tag field (> 3010), it has to be encoded in further octets: Long Form. The initial octet encodes the class and primitive/constructed as before, and bits 1–5 are 1. The tag number is encoded in the following octets, where bit 8 of each is 1 if there are more octets, and bits 1–7 encode the tag number. The tag number bits combined, big-endian, encode the tag number. The least number of following octets should be encoded; that is, bits 1–7 should not all be 0 in the first following octet.
Length octets There are two forms of the length octets: The definite form and the indefinite form.
Definite form This encodes the number of content octets and is always used if the type is primitive or constructed and data are immediately available. There is a short form and a long form, which can encode different ranges of lengths. Numeric data is encoded as unsigned integers with the least significant bit always first (to the right). The short form consists of a single octet in which bit 8 is 0, and bits 1–7 encode the length (which may be 0) as a number of octets. The long form consists of 1 initial octet followed by 1 or more subsequent octets, containing the length. In the initial octet, bit 8 is 1, and bits 1–7 (excluding the values 0 and 127) encode the number of octets that follow. The following octets encode, as big-endian, the length (which may be 0) as a number of octets.
Indefinite form This does not encode the length at all, but that the content octets finish at marker octets. This applies to constructed types and is typically used if the content is not immediately available at encoding time. It consists of a single octet, in which bit 8 is 1, and bits 1–7 are 0. Then, two end-of-contents octets must terminate the content octets.
Contents octets The contents octets encode the element data value. Note that there may be no contents octets (hence, the element has a length of 0) if only the existence of the ASN.1 object, or its emptiness, is to be noted. For example, this is the case for an ASN.1 NULL value.
CER encoding CER (Canonical Encoding Rules) is a restricted variant of BER for producing unequivocal transfer syntax for data structures described by ASN.1. Whereas BER gives choices as to how data values may be encoded, CER (together with DER) selects just one encoding from those allowed by the basic encoding rules, eliminating the rest of the options. CER is useful when the encodings must be preserved; e.g., in security exchanges.
DER encoding DER (Distinguished Encoding Rules) is a restricted variant of BER for producing unequivocal transfer syntax for data structures described by ASN.1. Like CER, DER encodings are valid BER encodings. DER is the same thing as BER with all but one sender's options removed. DER is a subset of BER providing for exactly one way to encode an ASN.1 value. DER is intended for situations when a unique encoding is needed, such as in cryptography, and ensures that a data structure that needs to be digitally signed produces a unique serialized representation. DER can be considered a canonical form of BER. For example, in BER a Boolean value of true can be encoded as any of 255 non-zero byte values, while in DER there is one way to encode a Boolean value of true. The most significant DER encoding constraints are:
… excerpt ends here. Continue reading the full article.
