Crypto-lingo
Recently I have found myself working with OpenSSL, trying to get it to generate PKCS #7 signatures in a very particular manner. It is not the first time I’ve had to work with this tool and its related protocols and formats but like every time I need to work with this I’ve had to relearn what each opaque and unpronounceable acronym stands for and how they relate to each other. In this page I try to summarize what each name stands for in an understandable manner so that next time I, or anyone who stumbles upon this, need to work again with thees tool, it will be easier to get my bearings.
ASN.1
ASN.1 is a language which lets standard makers describe data structures which can be stored or exchanged. For example when the PKCS #7 defines what a signature contains, it does that with ASN.1. Importantly, ASN.1 does not define a format to actually encode the contents of the structure; it defines only the shape of the structure.
DER
DER is a binary format for encoding structures described by ASN.1. Therefore, if a structure is defined by ASN.1, it can be encoded with DER into sequences of bytes fit for saving or exchanging. Private keys, certificates and certificate chains can all be saved in DER format.
PEM
PEM is base64-encoded DER with an added header and footer, such as
----- (header) or ----- (footer).
X.509
X.509 defines the format and workings of the certificates used for example by TLS and S/MIME. It uses ASN.1 to define this formally. Notably, it defines.
- What goes into a certificate signing request.
- What goes into a certificate.
- What goes into a certificate revocation list.
- How certificates sign each other.
- What makes a certificate valid.
PKCS #7
PKCS #7 is another standard that uses ASN.1 to define how to store signed or encrypted data. Its format for storing signed data allows storing the certificates alongside the data, and this is sometimes used to store just certificates, by not storing any data next to the certificates.
PKCS #12
PKCS #12 is a standard which defines how to store certificates, certificate chains and private keys in “bundles” of cryptographic data. It allows encryption of pieces of data, which is very useful to encrypt private keys.