pyasn1

pyasn1 gives Python programs a way to work with ASN.1 (X.208) data structures as native Python objects, then serialize and deserialize them using the BER, CER, and DER encoding rules. Rather than hand-rolling byte-level parsing for protocols and file formats that rely on ASN.1 — X.509 certificates, SNMP, LDAP, Kerberos, and many others — pyasn1 lets you declare typed classes (Sequence, Integer, OctetString, and so on) that mirror ASN.1 module definitions and handle the wire format underneath.

The library is a foundational, low-level dependency: it doesn’t ship protocol-specific modules itself, but higher-level packages like pyasn1-modules, pyOpenSSL, and rsa build directly on it to decode certificates and cryptographic structures. Its value is in doing the fiddly, standards-compliant encoding work once, correctly, so every downstream protocol implementation doesn’t have to.

What You Get

• A full set of ASN.1 type classes (Integer, OctetString, Sequence, Set, Choice, Any, and more) that behave like their closest Python built-in equivalents
• BER, CER, and DER encoder/decoder modules for turning typed objects into wire bytes and back
• A native codec that converts pyasn1 objects to and from plain Python dicts/lists for interop with JSON-style tooling
• Constraint and named-type machinery (NamedType, OptionalNamedType, DefaultedNamedType, ConstraintsIntersection) for expressing ASN.1 module semantics precisely in Python
• Streaming-capable decoding so large substrates can be processed incrementally rather than loaded fully into memory

Common Use Cases

• Parsing and validating X.509 certificates and certificate chains before handing them to a TLS/crypto library
• Implementing or debugging SNMP agents and managers that exchange BER-encoded PDUs
• Decoding LDAP or Kerberos protocol messages that are defined via ASN.1 modules
• Building a custom protocol compiler or codec on top of a compliant, well-tested ASN.1 type system instead of writing one from scratch

Under The Hood

Architecture pyasn1 splits cleanly into a type system (pyasn1/type/: base.py, univ.py, char.py, useful.py, namedtype.py, tag.py, constraint.py, tagmap.py) and a set of codecs (pyasn1/codec/{ber,cer,der,native}/) that operate purely against that type system’s public interface. Every ASN.1 value — scalar or constructed — is an Asn1Type subclass carrying its own tagSet and subtypeSpec, so a codec never needs protocol-specific knowledge: encoding and decoding are dispatched generically off the type’s tag and constraints. CER and DER encoders subclass and override only the parts of the BER encoder where their encoding rules diverge, keeping the three codecs in a clear specialization hierarchy rather than three parallel implementations. codec/streaming.py lets decoding consume a file-like stream instead of a fully materialized buffer, so the core abstraction change that would ripple furthest is the Asn1Type/tagSet contract itself — everything else, including every codec, is built on top of it.

Tech Stack The library has zero runtime dependencies and targets Python 3.8+ (per pyproject.toml), built with a standard setuptools backend and dynamic versioning sourced from pyasn1/__init__.py. It ships wheels via a dedicated pypi.yml GitHub Actions workflow, is tested across CPython 3.8-3.14 and PyPy through tox.ini, and is scanned with bandit and GitHub’s CodeQL for security issues. There is no build-time compiled extension — the whole codec stack is pure Python, which is also why the README calls out MT-safety and portability across interpreters.

Code Quality Tests live under tests/, mirroring the pyasn1/ package layout (tests/type/, tests/codec/{ber,cer,der,native}/) with 34 test modules built on unittest via a shared BaseTestCase, run with -Werror so warnings fail the suite, and gated at a minimum 80% coverage threshold in the cover tox environment. Exceptions are modeled as a real hierarchy (PyAsn1Error and its subclasses like ValueConstraintError, SubstrateUnderrunError, PyAsn1UnicodeDecodeError) rather than bare Exception or silently-swallowed errors, and each carries structured context for debugging. Naming favors explicit, descriptive method names (isSameTypeWith, isSuperTypeOf) over abbreviation, and CI runs the full matrix on every push.

What Makes It Unique pyasn1’s value isn’t a novel algorithm — ASN.1 and its encoding rules are a 40-year-old ITU standard — but it is the de facto reference implementation for doing that standard correctly in pure Python, with no native extension to compile or vendor. That reliability is precisely why it sits as a transitive dependency underneath much of the Python cryptography and networking ecosystem: correctness and standards compliance here get reused everywhere else rather than reimplemented per project.