#MoonBit PKI

A pure-MoonBit ASN.1 DER codec and X.509 certificate toolkit.

Published as oilleelssq-wq/MoonBit-PKI and developed at https://github.com/oilleelssq-wq/MoonBit-PKI.

The library is being built feature by feature. The ASN.1/DER codec, PEM support and the X.509 certificate parser are implemented and tested, together with an x509dump command line tool; certificate chain validation follows in a later increment.

#Why

MoonBit has no general-purpose ASN.1 or PKI library. Everything in the ecosystem that touches certificates, TLS, code signing, x5c JWT headers or PKCS structures ends up needing a DER decoder and an X.509 parser. The only related package on mooncakes.io today is a minimal DER reader aimed at RSA private keys, which covers PKCS#1/PKCS#8 but not certificates, extensions, CSRs or CRLs.

This module aims to fill that gap with a small, dependency-light, well-tested implementation:

A DER tag-length-value reader and writer with strict canonical checks.
Primitive codecs for the types used by certificates and keys: BOOLEAN, INTEGER, BIT STRING, OCTET STRING, NULL, the common string types and OBJECT IDENTIFIER.
UTCTime and GeneralizedTime decoding and canonical encoding.
A DerWriter for assembling sequences, sets and explicitly tagged values.
An object identifier type with dotted-decimal rendering.
PEM (RFC 7468) text encoding, including encapsulated headers.
X.509 certificate parsing: TBSCertificate, names, validity, subject public key, extensions, plus a summary renderer.
Extension decoding: subject/issuer alternative names (GeneralName), key usage, basic constraints, extended key usage and key identifiers.
An x509dump command line tool that prints a certificate, its extensions and its SHA-256/SHA-1 fingerprints.
PKCS#10 certification requests, including the extensions requested through the extensionRequest attribute.
Certificate revocation lists: revoked entries with their reason codes, and the CRL number extension.
Certificate chains: parse a PEM bundle and walk the issuer links from the leaf up to the root (structure only, no signature verification).
Later: signature verification.

#Goals

Keep the library packages free of dependencies; only the demo CLI uses moonbitlang/x for file access, exit codes and digests.
Work on every backend (wasm, wasm-gc, js, native).
Prefer zero-copy views over the input buffer.
Report malformed input through a precise error type instead of panicking.

#Install

moon add oilleelssq-wq/MoonBit-PKI

#Usage

Decode a value:

import { "oilleelssq-wq/MoonBit-PKI/asn1" @asn1 }

///|
test "read a DER integer" {
  let reader = @asn1.DerReader::from_bytes(b"\x02\x01\x2a")
  let value = try! reader.read_single()
  inspect(value.to_string(), content="[UNIVERSAL 2 primitive] 1B 2a")
}

Encode a value:

import { "oilleelssq-wq/MoonBit-PKI/asn1" @asn1 }

///|
test "build a sequence" {
  let writer = @asn1.DerWriter::new()
  writer.add(try! @asn1.encode_int(1)[:])
  writer.add(try! @asn1.encode_utf8_string("hi")[:])
  let encoded = try! writer.to_sequence()
  println(encoded.length().to_string())
}

#Packages

Package	Contents
oilleelssq-wq/MoonBit-PKI/asn1	DER reader and writer, value tree, primitive codecs, times, object identifiers
oilleelssq-wq/MoonBit-PKI/pem	RFC 7468 PEM block encoding and decoding
oilleelssq-wq/MoonBit-PKI/x509	X.509 certificates, PKCS#10 requests and CRLs
oilleelssq-wq/MoonBit-PKI/cmd/x509dump	Command line certificate dumper

#Command line

moon run cmd/x509dump -- certificate.pem

The tool accepts PEM or raw DER and recognises certificates, chains, PKCS#10 requests and revocation lists. It prints the subject, issuer, validity, public key, extensions, alternative names and the SHA-256/SHA-1 fingerprints:

Certificate
  Version: v3
  Serial number: 16304457158131191369
  Signature algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
  Issuer: CN=test.example.com,O=MoonBit PKI Test,C=CN
  Validity
    Not before: 2024-01-02T03:04:05Z
    Not after: 2034-01-02T03:04:05Z
  Subject: CN=test.example.com,O=MoonBit PKI Test,C=CN
  Public key: rsaEncryption, 2048 bits
  Extensions (3)
    subjectAltName (2.5.29.17) critical=false
    basicConstraints (2.5.29.19) critical=false
    keyUsage (2.5.29.15) critical=true
  Subject alternative names (3)
    DNS: test.example.com
    DNS: alt.example.com
    IP: 127.0.0.1
  SHA-256 fingerprint: dd:23:74:20:c2:10:42:dc:9d:c1:35:54:65:a2:b4:74:da:e8:59:50:61:26:29:e4:62:f5:1d:e7:5b:3e:b2:d5
  SHA-1 fingerprint: 20:bb:1b:e3:b5:4b:51:e4:a8:bf:8c:a7:0e:0a:32:5d:4e:05:a9:dd

#API overview

Item	Purpose
DerReader	Cursor over DER bytes: read_tlv, read_element, read_all, read_single
Der	Decoded tree of Primitive/Constructed values
Tag, TagClass	Decoded identifier octets
Der::as_integer, Der::as_string, Der::as_time, ...	Typed accessors for decoded values
decode_integer, decode_boolean, decode_bit_string, ...	Primitive content decoders
encode_int, encode_utf8_string, encode_tlv, ...	Primitive DER encoders
DerWriter	Assembles sequences, sets and explicitly tagged values
Asn1Time	UTCTime / GeneralizedTime values
ObjectIdentifier	Dotted-decimal OIDs
decode_pem, encode_pem	RFC 7468 PEM blocks
parse_certificate, parse_pem_certificate	X.509 certificates
Certificate, Name, Extension	Parsed certificate structures
CertificationRequest, Attribute	Parsed PKCS#10 requests
CertificateList, RevokedCertificate	Parsed revocation lists
parse_certificate_bundle, build_chain	PEM bundles and issuer walks
GeneralName, KeyUsage, BasicConstraints	Decoded extension values
DerError, PemError, X509Error	Decode and encode failures

#Development

moon check --target all --deny-warn
moon test --target all
moon fmt
moon info

#References

ITU-T X.680, Abstract Syntax Notation One (ASN.1): Specification of basic notation.
ITU-T X.690, ASN.1 encoding rules: BER, CER and DER.
RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile.

#License

Apache-2.0. See LICENSE.

Site source Report issue Packages Build queue Skills Statistics