For a simple example, I'm using a 512-bit RSA cert to illustrate my question. The cert can be found in both DER and PEM form here. I've been going through the certificate using this ASN.1 decoder (the provided link to the decoder already has the cert in question loaded).

For convenience, I've reproduced the hex bytes of the cert below:

 1  00000000: 3082 0212 3082 017b 0202 0dfa 300d 0609  0...0..{....0...
 2  00000010: 2a86 4886 f70d 0101 0505 0030 819b 310b  *.H........0..1.
 3  00000020: 3009 0603 5504 0613 024a 5031 0e30 0c06  0...U....JP1.0..
 4  00000030: 0355 0408 1305 546f 6b79 6f31 1030 0e06  .U....Tokyo1.0..
 5  00000040: 0355 0407 1307 4368 756f 2d6b 7531 1130  .U....Chuo-ku1.0
 6  00000050: 0f06 0355 040a 1308 4672 616e 6b34 4444  ...U....Frank4DD
 7  00000060: 3118 3016 0603 5504 0b13 0f57 6562 4365  1.0...U....WebCe
 8  00000070: 7274 2053 7570 706f 7274 3118 3016 0603  rt Support1.0...
 9  00000080: 5504 0313 0f46 7261 6e6b 3444 4420 5765  U....Frank4DD We
10  00000090: 6220 4341 3123 3021 0609 2a86 4886 f70d  b CA1#0!..*.H...
11  000000a0: 0109 0116 1473 7570 706f 7274 4066 7261  .....support@fra
12  000000b0: 6e6b 3464 642e 636f 6d30 1e17 0d31 3230  nk4dd.com0...120
13  000000c0: 3832 3230 3532 3635 345a 170d 3137 3038  822052654Z..1708
14  000000d0: 3231 3035 3236 3534 5a30 4a31 0b30 0906  21052654Z0J1.0..
15  000000e0: 0355 0406 1302 4a50 310e 300c 0603 5504  .U....JP1.0...U.
16  000000f0: 080c 0554 6f6b 796f 3111 300f 0603 5504  ...Tokyo1.0...U.
17  00000100: 0a0c 0846 7261 6e6b 3444 4431 1830 1606  ...Frank4DD1.0..
18  00000110: 0355 0403 0c0f 7777 772e 6578 616d 706c  .U....www.exampl
19  00000120: 652e 636f 6d30 5c30 0d06 092a 8648 86f7  e.com0\0...*.H..

20  00000130: 0d01 0101 0500 034b 0030 4802 4100 9bfc  .......K.0H.A...

21  00000140: 6690 7984 42bb ab13 fd2b 7bf8 de15 12e5  f.y.B....+{.....
22  00000150: f193 e306 8a7b b8b1 e19e 26bb 9501 bfe7  .....{....&.....
23  00000160: 30ed 6485 02dd 1569 a834 b006 ec3f 353c  0.d....i.4...?5<
24  00000170: 1e1b 2b8f fa8f 001b df07 c6ac 5307 0203  ..+.........S...
25  00000180: 0100 0130 0d06 092a 8648 86f7 0d01 0105  ...0...*.H......
26  00000190: 0500 0381 8100 14b6 4cbb 8179 33e6 71a4  ........L..y3.q.
27  000001a0: da51 6fcb 081d 8d60 ecbc 18c7 7347 59b1  .Qo....`....sGY.
28  000001b0: f220 48bb 61fa fc4d ad89 8dd1 21eb d5d8  . H.a..M....!...
29  000001c0: e5ba d6a6 36fd 7450 83b6 0fc7 1ddf 7de5  ....6.tP......}.
30  000001d0: 2e81 7f45 e09f e23e 79ee d730 31c7 2072  ...E...>y..01. r
31  000001e0: d958 2e2a fe12 5a34 45a1 1908 7c89 475f  .X.*..Z4E...|.G_
32  000001f0: 4a95 be23 214a 5372 da2a 052f 2ec9 70f6  J..#!JSr.*./..p.
33  00000200: 5bfa fddf b431 b2c1 4a9c 0625 43a1 e6b4  [....1..J..%C...
34  00000210: 1e7f 869b 1640                           .....@

Notice that in Line 20, we have, starting at the 7th byte, the sequence 03 4B 00 30 48 02 41 00... which indicates

If we ignore this first byte and look at the rest of this bitstring, we can parse the bytes according to the DER encoding rules as a sequence of 72 (0x48) bytes, which encode the modulus and exponent of the RSA public key as integers.

We notice that the modulus itself begins with 02 41 00 ..., indicating

  • an integer (0x02)
  • of 65 (0x41) bytes
  • and also starting with the byte 00.

My question is, why are these bytes here? For the modulus, which is interpreted as an integer, this null byte shouldn't be a problem. However, at the beginning of a sequence, it seems to indicate an EOC tag, which doesn't make sense, since the cert is DER encoded.

Thanks in advance for your help.

up vote 5 down vote accepted

ASN.1 BIT STRING can be any length, so the DER/BER encoding rounds up to a multiple of 8 (an integral number of octets) and prefixes one octet containing the count of added padding bits. Since this BIT STRING value is itself a DER encoding and thus already a multiple of 8 bits, the padding count is 00.

ASN.1 INTEGER is signed, and the DER/BER encoding is two's complement big-endian. Your N value 9BFC...5307 has a magnitude that is an exact multiple of 8 bits; this is common since most RSA moduli are deliberately chosen to make their size in bits a power of 2 higher than 23, or a small multiple thereof, in your case 512. For this to be represented as a signed number a 0-bit must be prefixed, and since the encoding must be integral octets in fact we prefix a full 00 octet.

Back in the 1990s when RSADSI established a series of Public Key Cryptographic Standards (PKCS) using a good deal of ASN.1, Burt Kaliski wrote a "Layman's Guide" that covered a lot of useful details about ASN.1 quickly; see especially 5.4 and 5.7 in this apparently definitive reference or this more convenient but uncertainly permanent one.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.