`asn1/oid` — OBJECT IDENTIFIER encode / decode

Purpose

Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensions, key purposes, name attributes, and policies — every dispatch site in this package keys on a dotted-decimal string returned by decodeOid. The encoder is needed only for synthesising test fixtures since parseCertificate never re-emits OIDs onto the wire.

Features

Folded first-arc decoding (X.690 paragraph 8.19.4): the leading sub-identifier splits into two arcs by the value < 80 / value >= 80 rule.
Minimal sub-identifier check — leading 0x80 byte on a sub-identifier is rejected as non-minimal.
Truncation guard — a sub-identifier that ends mid-byte (high-bit set on final byte) is rejected.
Symmetric encoder — produces the same byte sequence the decoder would consume.

Usage: Basic Example

import { decodeOid, encodeOid } from "@suaveplan/x509/asn1";

const dotted = decodeOid(new Uint8Array([0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b]));
// "1.2.840.113549.1.1.11" (sha256WithRSAEncryption)

const back = encodeOid("1.2.840.113549.1.1.11");

Usage: Advanced Example

import { decodeOid, encodeOid } from "@suaveplan/x509/asn1";

// Round-trip every OID in a recognised set:
const OIDS = [
    "2.5.29.17",       // subjectAltName
    "2.5.29.19",       // basicConstraints
    "1.3.101.112",     // id-Ed25519
];
for (const o of OIDS) {
    const body = encodeOid(o);
    const back = decodeOid(body);
    if (back !== o) throw new Error("round-trip mismatch");
}

API Reference

decodeOid(body: Uint8Array): string — OID body (without outer tag-length) into dotted-decimal string. Throws X509Error(ASN1_MALFORMED) on empty body, non-minimal sub-id, or truncation.
encodeOid(dotted: string): Uint8Array — dotted-decimal into OID body. Throws on negative or non-decimal arcs, or invalid first two arcs.

Implementation Notes

Decoder uses bigint arithmetic for sub-identifiers — production OIDs occasionally exceed 32 bits (e.g. some experimental private-enterprise IDs).
arc1 ∈ {0, 1, 2}; arc2 < 40 when arc1 < 2. The encoder validates this constraint and folds correctly.
Empty OIDs are rejected — every X.509 production that carries an OID requires at least two arcs.

2.3 KiB Raw Blame History

asn1/oid — OBJECT IDENTIFIER encode / decode