ASN.1
Abstract Syntax Notation One
What is ASN.1
● Way of representing objects
● Used for abstraction in OSI model
● Can represent simple atomic (Integer,
String etc.) and complex data structures
Why not JSON or XML
● ASN.1 is chosen for efficiency. Not
babysitting the codec writers
● JSON / XML takes up too much
overhead in transmitting
● ASN.1 can do it with way less. Thus, less
bandwidth / lesser resources
● But encoding / decoding / debugging is
hard.
Compare XML / JSON
{ “vehicle”: {
“wheelCount”: 4,
“registration”: “3421”
}}
73 bytes
<vehicle>
<wheelCount>4</wheelCount>
<registration>3421<registration>
</vehicle>
81 bytes
A0 07 02 01 04 16 02 43 12
8 bytes!
Note that in both cases, both the encoding and decoding entities
MUST have prior knowledge of the data structure
Encoding / Decoding
● Done using encoding rules.
● BER (Basic Encoding Rules) is the most
popular method
○ Used in TCAP, MAP, CAP
● CER, DER and some others are present
Encoding / Decoding
Basic Encoding Rules
Primitive
Types
Constructed Types
Definite
Length
Infinite
Length
Data Structure
Encoded as
● Tag and Length are one or multiple
bytes
● Content is zero or multiple bytes
LENGTH CONTENTTAG
Data Structure
● The TAG identifies the data structure
● LENGTH specifies the number of trailing
bytes in the CONTENT to follow
● CONTENT...well...what do you think?
LENGTH CONTENTTAG
TAG Octets
● TAG consists of three parts in BER
○ Class
○ Indication of whether the structure is
primitive or compound
○ Tag value
7 6 5 4 3 2 1 0
Class P/C Tag
00 : Universal | 01: Application | 10: Context specific | 11: Private
TAG
TAG Octets
● In our car example:
{ “vehicle”: {
“wheelCount”: 4,
“registration”: “3421”
}}
The wheel count is an integer.
ASN is of class UNIVERSAL (0x00), a PRIMITIVE (0) and
INTEGER (Tag 2)
Thus 0x02:
0 0 0 0 0 0 1 0
TAG
TAG Octets
● What happens when the tag value cannot
be represented in the given 5 bits. i.e.
Tags > 31
● If the tag is greater than 30, The TAG
octet will become TAG octets.
● The first byte’s tag part will have five 1’s
● Then the other tailing bytes will
represent the value. in 7 bits each. with
MSB as 1.
● The end is shown with MSB 0.
TAG
Confused?
Good! Then lets try it out.
LENGTH Octets
● Definite lengths from 0 to 127 will be
represented in the length byte.
● If the length is greater than 127, the long
form takes over (just like in TAG octets)
● The MSB is made 1. The rest of the LSBs
represent the number of trailing bytes
which really gives out the length.
LENGTH
Confused again?
Oh you poor souls!
LENGTH Octets
The indefinite length is noted with a length
octet being 0x80. i.e. MSB 1 and rest zero
1 0 0 0 0 0 0 0
The contents in this case will be terminated
with a special ASN tag with TAG 0 and
LENGTH 0
i.e. 0x00 0x00
Food for thought: What happens if your data in one
of the containers has two consecutive 0s?
LENGTH
CONTENT Octets
● Contents can be a primitive data type like
INTEGER or String
● Or it can be another Tag|Length|Content
structure or multiples of it.
● As long as there are LENGTH bytes
trailing, there is no issue, whatever it is.
CONTENT
Let’s look at TCAP with Wireshark
References
ITU specification document
http://goo.gl/PBXEup
Laymen’s guide to ASN
http://goo.gl/XJqL4s

ASN.1 Basics

  • 1.
  • 2.
    What is ASN.1 ●Way of representing objects ● Used for abstraction in OSI model ● Can represent simple atomic (Integer, String etc.) and complex data structures
  • 3.
    Why not JSONor XML ● ASN.1 is chosen for efficiency. Not babysitting the codec writers ● JSON / XML takes up too much overhead in transmitting ● ASN.1 can do it with way less. Thus, less bandwidth / lesser resources ● But encoding / decoding / debugging is hard.
  • 4.
    Compare XML /JSON { “vehicle”: { “wheelCount”: 4, “registration”: “3421” }} 73 bytes <vehicle> <wheelCount>4</wheelCount> <registration>3421<registration> </vehicle> 81 bytes A0 07 02 01 04 16 02 43 12 8 bytes! Note that in both cases, both the encoding and decoding entities MUST have prior knowledge of the data structure
  • 5.
    Encoding / Decoding ●Done using encoding rules. ● BER (Basic Encoding Rules) is the most popular method ○ Used in TCAP, MAP, CAP ● CER, DER and some others are present
  • 6.
    Encoding / Decoding BasicEncoding Rules Primitive Types Constructed Types Definite Length Infinite Length
  • 7.
    Data Structure Encoded as ●Tag and Length are one or multiple bytes ● Content is zero or multiple bytes LENGTH CONTENTTAG
  • 8.
    Data Structure ● TheTAG identifies the data structure ● LENGTH specifies the number of trailing bytes in the CONTENT to follow ● CONTENT...well...what do you think? LENGTH CONTENTTAG
  • 9.
    TAG Octets ● TAGconsists of three parts in BER ○ Class ○ Indication of whether the structure is primitive or compound ○ Tag value 7 6 5 4 3 2 1 0 Class P/C Tag 00 : Universal | 01: Application | 10: Context specific | 11: Private TAG
  • 10.
    TAG Octets ● Inour car example: { “vehicle”: { “wheelCount”: 4, “registration”: “3421” }} The wheel count is an integer. ASN is of class UNIVERSAL (0x00), a PRIMITIVE (0) and INTEGER (Tag 2) Thus 0x02: 0 0 0 0 0 0 1 0 TAG
  • 11.
    TAG Octets ● Whathappens when the tag value cannot be represented in the given 5 bits. i.e. Tags > 31 ● If the tag is greater than 30, The TAG octet will become TAG octets. ● The first byte’s tag part will have five 1’s ● Then the other tailing bytes will represent the value. in 7 bits each. with MSB as 1. ● The end is shown with MSB 0. TAG
  • 12.
  • 13.
    LENGTH Octets ● Definitelengths from 0 to 127 will be represented in the length byte. ● If the length is greater than 127, the long form takes over (just like in TAG octets) ● The MSB is made 1. The rest of the LSBs represent the number of trailing bytes which really gives out the length. LENGTH
  • 14.
  • 15.
    LENGTH Octets The indefinitelength is noted with a length octet being 0x80. i.e. MSB 1 and rest zero 1 0 0 0 0 0 0 0 The contents in this case will be terminated with a special ASN tag with TAG 0 and LENGTH 0 i.e. 0x00 0x00 Food for thought: What happens if your data in one of the containers has two consecutive 0s? LENGTH
  • 16.
    CONTENT Octets ● Contentscan be a primitive data type like INTEGER or String ● Or it can be another Tag|Length|Content structure or multiples of it. ● As long as there are LENGTH bytes trailing, there is no issue, whatever it is. CONTENT
  • 17.
    Let’s look atTCAP with Wireshark
  • 18.