DER Editing, Easy-Peasy With asn1template

DER is the binary encoding of ASN.1 structures, and it is the format that carries X.509 certificates in TLS and similar protocols. Editing it directly is awkward because every length and offset depends on the content, so changing one field, such as a value that grows from two characters to three, shifts everything that follows. The speaker presents asn1template, a small Python script that converts a DER file into a text description that OpenSSL can read back.

The text output follows the format expected by OpenSSL's ASN1_generate_nconf function, so a file can be edited as plain text and regenerated into valid DER. In the demo, a certificate's country code was changed from US to a three-letter value. The regenerated certificate was then compared with the original, showing the changed field and the shifted offsets. The speaker said the tool helped with two recent CVEs: one involving an infinite loop in elliptic curve key handling, and another involving very large identifiers in these structures. The tool also handles files that concatenate several DER structures, such as eim files.

The script has few dependencies and runs on Linux and OpenBSD. It can also work with LibreSSL and BoringSSL, provided a small amount of C code is added to reach the regeneration function. A practitioner could use it to craft unusual certificates for CTF challenges or to test how a parser handles malformed input.