Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

DER Serialization Problem

Open
  • Is something wrong?
#249 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
rust
Domain
cryptography

Research direction

Reproduce the two DER outputs from the issue using picky_asn1_der, then inspect the RdnSequence, Name, and GeneralName serialization definitions involved. Compare the emitted tags with the RFC 5280 structures and OpenSSL's parsing behavior. Done means the serialization matches the intended ASN.1 tagging and the SAN content is accepted by OpenSSL.

Written by the indexing model from the issue text.

Description

Hi all,

I noticed two potential problems when serializing a custom SAN containing a directory name using the picky_asn1_der crate.
Please, read them below.

Potential Problem 1

According to RFC 5280, the SAN should follow:

id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }

SubjectAltName ::= GeneralNames

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE {
otherName                       [0]     OtherName,
rfc822Name                      [1]     IA5String,
dNSName                         [2]     IA5String,
x400Address                     [3]     ORAddress,
directoryName                   [4]     Name,
ediPartyName                    [5]     EDIPartyName,
uniformResourceIdentifier       [6]     IA5String,
iPAddress                       [7]     OCTET STRING,
registeredID                    [8]     OBJECT IDENTIFIER }

OtherName ::= SEQUENCE {
type-id    OBJECT IDENTIFIER,
value      [0] EXPLICIT ANY DEFINED BY type-id }

EDIPartyName ::= SEQUENCE {
nameAssigner            [0]     DirectoryString OPTIONAL,
partyName               [1]     DirectoryString }

and:

Name ::= CHOICE { -- only one possibility for now --
rdnSequence  RDNSequence }

RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

RelativeDistinguishedName ::=
SET SIZE (1..MAX) OF AttributeTypeAndValue

AttributeTypeAndValue ::= SEQUENCE {
type     AttributeType,
value    AttributeValue }

AttributeType ::= OBJECT IDENTIFIER

AttributeValue ::= ANY -- DEFINED BY AttributeType

DirectoryString ::= CHOICE {
 teletexString           TeletexString (SIZE (1..MAX)),
 printableString         PrintableString (SIZE (1..MAX)),
 universalString         UniversalString (SIZE (1..MAX)),
 utf8String              UTF8String (SIZE (1..MAX)),
 bmpString               BMPString (SIZE (1..MAX)) }

But when implementing it in Rust, the sequence tag for RDNSequence disappears. Please, see the code snippet below.

let rdn_sequence = RdnSequence::from(vec![RelativeDistinguishedName::from(vec![
    AttributeTypeAndValue::new_common_name("test"),
])]);

let der_rdn_sequence = picky_asn1_der::to_vec(&rdn_sequence).unwrap();

println!("DER RDN sequence name: {}", hex::encode(der_rdn_sequence));

let der_general_names =
    picky_asn1_der::to_vec(&GeneralNames::from(vec![GeneralName::DirectoryName(Name(
        rdn_sequence,
    ))]))
    .unwrap();

println!("DER     general names: {}", hex::encode(der_general_names));

The output is:

DER RDN sequence name:     300f310d300b06035504030c0474657374
DER     general names: 3011840f310d300b06035504030c0474657374

where 300f disappeared from the serialized value. Did I miss anything?

Potential Problem 2

Another question, as I'm constructing the SAN, shouldn't the tag for Name be 0xa4 instead of 0x84 in the output above?
If I try to visualize the SAN content with tag 0x84 using the openssl CLI, it dumps binary, but with tag 0xa4 it parses the DER content as expected.

Dominant language
Rust
Stars
70
Forks
43
Avg merge
2d 12h
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Devolutions/picky-rs

All issues in Devolutions/picky-rs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.