6

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure.

I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from any programmer error. I think the best way to do this is to use a managed language that does not use unsafe code.

Are there any managed implementations (C#) of an ASN.1 parser that is well tested and safe from buffer overflows. Even better if there was a way to detect such an overflow to begin with.

4
  • Ever heard of valgrind? Jul 22, 2013 at 16:15
  • 1
    @FlorianMargaine - I fail to understand your reference. valgrind doesn't work with CLR. Jul 22, 2013 at 16:27
  • I'm just saying that valgrind helps avoid overflows in un-managed languages, such as C/C++. Besides, C++ is almost a managed language nowadays. Jul 22, 2013 at 16:37
  • Valgrind helps - its not the answer, otherwise all you would need to write software such as Avionics is a clean Valgrind report.....
    – mattnz
    Jul 22, 2013 at 21:35

1 Answer 1

9

Please take a look at http://www.itu.int/ITU-T/asn1/links/index.htm which has an excellent list of ASN.1 tools (some commercial, some free), some of which are widely used in critical infrastructure around the world.

One of these vendors (who I work for) is OSS Nokalva (http://www.oss.com) where you can find ASN.1 Tools for C, C++, C# and Java for which you can download free trials.

Please note that just using a language like C# or Java is no guarantee against maliciously formed ASN.1 encoded messages. Well written code and thorough enough testing can ensure that code is solid. The wide deployment of ASN.1 software in many critical applications is a testament to how well written some ASN.1 engines are. Note that you are more likely to find robust code from a widely used commercial ASN.1 Tool (which includes technical support) than from some of the free ASN.1 Tools which are available.

2
  • 3
    That's why I love this site: professionals working in the field answering. Jul 22, 2013 at 18:52
  • +1 for "...language like C# or Java is no guarantee against maliciously formed...."
    – mattnz
    Jul 22, 2013 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.