Table of contents
Namespace: Com\Tecnick\Pdf\Sign\Cms
File: Asn1.php line 38
Minimal DER ASN.1 encoder/decoder used to assemble and inspect CMS/CAdES structures, RFC 3161 timestamp messages, and OCSP requests. Only the subset of ASN.1 needed by PDF signatures is implemented.
Tags
- since: 2026-07-15
- category: Library
- author: Nicola Asuni info@tecnick.com
- copyright: 2026 Nicola Asuni - Tecnick.com LTD
- license: https://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE)
- link: https://github.com/tecnickcom/tc-lib-pdf-sign
Methods
assertMinimalInteger()
File: Asn1.php line 568
public assertMinimalInteger(string $value) : void
The minimality half of decodeInteger(), for fields carrying an integer too wide to decode, such as a certificate serial number of up to 20 octets (RFC 5280 section 4.1.2.2).
Parameters
- $value : string: Content octets (without tag/length).
Tags
- throws: Exception If the value is empty or non-minimally encoded.
assertSingleElement()
File: Asn1.php line 370
public assertSingleElement(string $value, int $tag, string $label) : void
Parameters
- $value : string
- $tag : int: Expected identifier octet.
- $label : string: Name of the value, for the error message.
Tags
- throws: Exception If the value is empty, truncated, trailed, or of another tag.
decodeAlgorithmIdentifier()
File: Asn1.php line 473
public decodeAlgorithmIdentifier(string $algorithmIdDer, string $label) : string
RFC 5280 section 4.1.1.2 shapes it as SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL }, so one element may follow the OID and nothing may follow that. Both layers are bounded here rather than in each reader.
Parameters
- $algorithmIdDer : string: Complete DER of the AlgorithmIdentifier.
- $label : string: Name of the field, for the error messages.
Tags
- throws: Exception If the structure is malformed, trailed, or names no OID.
Return values
string
decodeBitString()
File: Asn1.php line 716
public decodeBitString(array{tag: int, value: string, raw: string} $element) : string
Every BIT STRING read here holds whole octets (a signature, a public key), so a non-zero unused-bits count is refused.
Parameters
- $element : array{tag: int, value: string, raw: string}: Parsed TLV.
Tags
- throws: Exception If the element is not a BIT STRING of whole octets.
Return values
string
decodeExtensions()
File: Asn1.php line 394
public decodeExtensions(string $extensionsDer, string $label) : array<string, array{critical: bool, value: string}>
The shape is the one RFC 5280 section 4.1 defines: a SEQUENCE of SEQUENCE { extnID OBJECT IDENTIFIER, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING }.
The input has to be exactly one Extensions SEQUENCE with no trailing bytes. An OID that appears twice is refused: RFC 5280 sections 4.2 and 5.2 admit at most one instance of each type.
Parameters
- $extensionsDer : string: Complete DER of the Extensions SEQUENCE, or ’’ when the field is absent.
- $label : string: Name of the field, for the error messages.
Tags
- throws: Exception If the structure is malformed, trailed, or an OID appears twice.
Return values
array<string, array{critical: bool, value: string}>
decodeGeneralizedTime()
File: Asn1.php line 631
public decodeGeneralizedTime(string $value[, bool $allowFraction = false ]) : int
The seconds must be present and the zone must be Z (X.690 section 11.7). The fractional part is refused unless the caller opts in; when accepted it must hold at least one digit and no trailing zero (X.690 section 11.7), and is dropped once validated.
Every field is range-checked by re-encoding the result and comparing it with the input, since gmmktime() wraps an out-of-range field rather than failing.
Parameters
- $value : string: Content octets (without tag/length).
- $allowFraction : bool = false: Accept a fraction-of-second part, admitted by RFC 3161 section 2.4.2 for a token’s genTime.
Tags
- throws: Exception If the value is not a DER GeneralizedTime.
Return values
int
decodeInteger()
File: Asn1.php line 597
public decodeInteger(string $value) : int
The content octets are two’s complement (X.690 section 8.3), so the sign bit is honoured. A value too wide for a PHP integer is rejected.
Parameters
- $value : string: Content octets (without tag/length).
Tags
- throws: Exception If the value is empty, non-minimal, or out of range.
Return values
int
decodeObjectIdentifier()
File: Asn1.php line 736
public decodeObjectIdentifier(string $value) : string
The inverse of encodeObjectIdentifier(): the first subidentifier carries both leading arcs (X.690 section 8.19.4), and the rest are base-128 with continuation bits.
Parameters
- $value : string: Content octets (without tag/length).
Tags
- throws: Exception If the value is empty, truncated, or non-minimally encoded.
Return values
string
decodeTime()
File: Asn1.php line 697
public decodeTime(array{tag: int, value: string, raw: string} $element) : int
X.509 carries validity and revocation instants as a CHOICE of UTCTime and GeneralizedTime, so a reader has to accept whichever the issuer used.
Parameters
- $element : array{tag: int, value: string, raw: string}: Parsed TLV.
Tags
- throws: Exception If the element is neither a UTCTime nor a GeneralizedTime.
Return values
int
decodeUtcTime()
File: Asn1.php line 674
public decodeUtcTime(string $value) : int
DER requires the YYMMDDHHMMSSZ form (X.690 section 11.8). The two-digit year is read as 1950-2049, per RFC 5280 section 4.1.2.5.1.
Parameters
- $value : string: Content octets (without tag/length).
Tags
- throws: Exception If the value is not a DER UTCTime.
Return values
int
encodeBase128Int()
File: Asn1.php line 264
public encodeBase128Int(int $value) : string
Parameters
- $value : int: Integer value; must not be negative.
Tags
- throws: Exception If the value is negative.
Return values
string
encodeBoolean()
File: Asn1.php line 138
public encodeBoolean(bool $value) : string
Parameters
- $value : bool
Return values
string
encodeContext()
File: Asn1.php line 191
public encodeContext(int $number, string $value) : string
The multi-octet tag form (X.690 section 8.1.2.4) is not emitted, so tag numbers of 31 and above are rejected.
Parameters
- $number : int: Context tag number; must be 0..30.
- $value : string
Tags
- throws: Exception If the tag number is out of range or the length cannot be encoded.
Return values
string
encodeInteger()
File: Asn1.php line 82
public encodeInteger(int $value) : string
Parameters
- $value : int: Integer value; must not be negative.
Tags
- throws: Exception If the value is negative or the length cannot be encoded.
Return values
string
encodeIntegerBytes()
File: Asn1.php line 115
public encodeIntegerBytes(string $bytes) : string
Trims superfluous leading zero octets and prepends a zero octet when the most significant bit is set, so the value stays non-negative.
Parameters
- $bytes : string
Tags
- throws: Exception If the length cannot be encoded.
Return values
string
encodeLength()
File: Asn1.php line 47
public encodeLength(int $length) : string
Parameters
- $length : int: Number of content octets; must not be negative.
Tags
- throws: Exception If the length is negative or too large to encode.
Return values
string
encodeNull()
File: Asn1.php line 146
public encodeNull() : string
Return values
string
encodeObjectIdentifier()
File: Asn1.php line 209
public encodeObjectIdentifier(string $oid) : string
The first two arcs share one subidentifier with the value 40*arc0 + arc1, itself base-128 encoded (X.690 sections 8.19.2 and 8.19.4). The root arc is limited to 0..2, and the second arc to 0..39 under roots 0 and 1.
Parameters
- $oid : string
Tags
- throws: Exception If the OID is malformed or the length cannot be encoded.
Return values
string
encodeOctetString()
File: Asn1.php line 156
public encodeOctetString(string $value) : string
Parameters
- $value : string
Tags
- throws: Exception If the length cannot be encoded.
Return values
string
encodeSequence()
File: Asn1.php line 166
public encodeSequence(string $value) : string
Parameters
- $value : string
Tags
- throws: Exception If the length cannot be encoded.
Return values
string
encodeSet()
File: Asn1.php line 176
public encodeSet(string $value) : string
Parameters
- $value : string
Tags
- throws: Exception If the length cannot be encoded.
Return values
string
readLength()
File: Asn1.php line 515
public readLength(string $data, int &$offset) : int
The indefinite form and non-minimal long forms are rejected: DER requires the definite form with the fewest possible octets (X.690 section 10.1). The octet count is also capped so the accumulated length always fits a PHP integer, which on a 32-bit build is narrower than the 4-octet DER maximum.
Parameters
- $data : string
- $offset : int: Read cursor; advanced past the length octets.
Tags
- throws: Exception If the length is malformed or unsupported.
Return values
int
readOptionalTlv()
File: Asn1.php line 332
public readOptionalTlv(string $data, int &$offset) : array{tag: int, value: string, raw: string}|null
Parameters
- $data : string
- $offset : int: Read cursor; advanced past the parsed element.
Tags
- throws: Exception If the structure or length is malformed.
Return values
array{tag: int, value: string, raw: string}|null
readSingleElement()
File: Asn1.php line 347
public readSingleElement(string $value, int $tag, string $label) : array{tag: int, value: string, raw: string}
Parameters
- $value : string
- $tag : int: Expected identifier octet.
- $label : string: Name of the value, for the error message.
Tags
- throws: Exception If the value is empty, truncated, trailed, or of another tag.
Return values
array{tag: int, value: string, raw: string}
readTlv()
File: Asn1.php line 295
public readTlv(string $data, int &$offset) : array{tag: int, value: string, raw: string}
Parameters
- $data : string
- $offset : int: Read cursor; advanced past the parsed element.
Tags
- throws: Exception If the structure or length is malformed.
Return values
array{tag: int, value: string, raw: string}