asn1crypto

asn1crypto is a pure Python library for parsing and serializing ASN.1 (Abstract Syntax Notation One) structures — the binary encoding format underlying most PKI and cryptographic standards, including X.509 certificates, certificate revocation lists (CRLs), certificate signing requests (CSRs), OCSP, CMS/PKCS#7, PKCS#8, PKCS#12, and RSA/DSA/EC keys. It was created as a faster, more pythonic alternative to pyasn1, whose method-driven, lowerCamelCase API and slow parsing made it impractical for large structures like multi-megabyte CRLs.

The library achieves its performance through delayed parsing of byte string values, lazy loading of child fields, and persistence of the original DER-encoded bytes until a value is explicitly changed, avoiding redundant re-encoding. It ships pre-built ASN.1 type definitions for the most common cryptographic standards as ready-to-use Python classes, so developers can decode a certificate or signed message into native Python data structures (dicts, native types, datetimes) without hand-writing ASN.1 schemas.

asn1crypto has no third-party dependencies and forms the foundation of the modularcrypto family of packages (oscrypto, csrbuilder, certbuilder, crlbuilder, ocspbuilder, certvalidator), and is a transitive dependency of tools across the Python cryptography ecosystem that need to inspect or construct PKI structures.

What You Get

• A load() function and Asn1Value hierarchy (Sequence, Choice, SequenceOf, Integer, OctetString, BitString, etc.) covering the universal ASN.1 types
• Ready-made structure definitions for X.509 (asn1crypto.x509), CRL, CSR, OCSP, CMS/PKCS#7 (asn1crypto.cms), TSP, and PDF signatures, each mapped to its governing RFC
• Key format support for PKCS#1 RSA keys, DSA keys, elliptic curve keys (SEC1), and PKCS#8 containers via asn1crypto.keys
• A low-level parser module (emit(), parse(), peek()) for direct DER encoding/decoding when the higher-level structure classes aren’t needed
• PEM encode/decode helpers and timezone-aware datetime utilities (asn1crypto.util) for handling GeneralizedTime/UTCTime fields
• Zero third-party runtime dependencies, keeping it lightweight to vendor into other cryptography tooling

Common Use Cases

• Parsing an X.509 certificate’s fields (subject, issuer, validity, extensions, public key) into native Python objects for inspection or validation
• Decoding CMS/PKCS#7 signed or enveloped messages, such as email signatures or code-signing payloads
• Building or inspecting CSRs when implementing a certificate authority or ACME-style automation tool
• Parsing OCSP requests/responses or CRLs to check certificate revocation status
• Extracting and re-serializing RSA/DSA/EC private and public keys stored in PKCS#1, PKCS#8, or PKCS#12 containers

Under The Hood

Architecture asn1crypto is organized as a low-level parser.py (DER header/content parsing via emit(), parse(), peek()) beneath a core.py type hierarchy (Asn1Value, Sequence, Choice, SequenceOf, and the ASN.1 universal types), with domain-specific structure modules (x509.py, cms.py, crl.py, csr.py, ocsp.py, keys.py, algos.py, pkcs12.py, tsp.py, pdf.py) built entirely by subclassing that hierarchy and declaring per-field ASN.1 tags rather than writing custom parsing code. Values are lazily materialized: the original DER bytes are retained on an instance and only re-encoded if a field is explicitly mutated, and child fields of Sequence/SequenceOf are parsed on first access rather than eagerly, which is what lets a 21MB CRL parse in seconds instead of the ~4,100 seconds pyasn1 took on the same file per the project’s own benchmark. Because every higher-level structure (x509, cms, csr, etc.) is defined declaratively on top of the same core.py base classes, changing that core parsing/lazy-loading behavior would ripple through every structure module at once.

Tech Stack The library is pure Python with zero third-party runtime dependencies, supporting an unusually wide interpreter matrix (CPython 2.6 through 3.14, plus PyPy) validated via tox.ini and a GitHub Actions/CircleCI matrix covering Windows, macOS, Linux, and arm64. Packaging uses classic setuptools/setup.py rather than a pyproject.toml-based build backend, versioned in lockstep via asn1crypto/version.py. Optional codec support (_teletex_codec.py) and helper internals (_inet.py, _iri.py, _int.py) handle IP/IRI address and integer-encoding edge cases needed by the X.509 and related standards.

Code Quality Testing uses the stdlib unittest framework with one dedicated test module per structure area (test_x509.py, test_cms.py, test_crl.py, test_keys.py, test_pkcs12.py, etc.) plus fixture data under tests/fixtures/, giving comprehensive coverage across the full range of supported standards; the project runs its suite across every supported Python version in CI rather than a single pinned version. Linting is enforced via flake8 (with pinned mccabe/pycodestyle/pyflakes versions per Python version) and a 120-character line-length convention, run through a custom run.py ci task rather than a modern one-command runner. Naming and structure favor explicit method-driven APIs over magic, with extensive docstrings on public functions.

What Makes It Unique asn1crypto’s defining technical choice is representing cryptographic structures as native ASN.1 type definitions with lazy, byte-preserving parsing, rather than eagerly converting to intermediate Python objects the way its predecessor pyasn1 does — this is what produces its order-of-magnitude (or greater) performance advantage on large structures. It also correctly re-interprets universal ASN.1 types used unconventionally in crypto standards (e.g., signatures encoded as BitString, EC key components encoded as BitString/OctetString but meant as integers), avoiding a wasteful double-parse that naive ASN.1 libraries incur.