Add Name.from_bytes for parsing a Name from DER bytes (pyca#14980)

alex · claude · web-flow · commit 280c0264b5e3 · 2026-06-07T15:11:57.000-07:00
* Add Name.from_bytes for parsing a Name from DER bytes This is the inverse of Name.public_bytes. https://claude.ai/code/session_01TpZ3ogUWEYqoazBJn9ExmF * Fold round-trip assertion into test_from_bytes https://claude.ai/code/session_01TpZ3ogUWEYqoazBJn9ExmF --------- Co-authored-by: Claude <noreply@anthropic.com>
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -40,6 +40,9 @@ Changelog
   registers an :class:`enum.Enum` subclass as an ASN.1 value set: members
   are encoded as their underlying value, and decoding fails if the decoded
   value does not match one of the declared members.
+* Added :meth:`~cryptography.x509.Name.from_bytes` for parsing a
+  :class:`~cryptography.x509.Name` from DER bytes, the inverse of
+  :meth:`~cryptography.x509.Name.public_bytes`.
 
 .. _v48-0-0:
 
diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst
@@ -1633,6 +1633,23 @@ X.509 CSR (Certificate Signing Request) Builder Object
 
         :type: list of :class:`RelativeDistinguishedName`
 
+    .. classmethod:: from_bytes(data)
+
+        .. versionadded:: 49.0.0
+
+        Parse a DER encoded name (the inverse of :meth:`public_bytes`).
+
+        :param bytes data: The DER encoded name.
+
+        :returns: A :class:`Name` parsed from ``data``.
+
+        .. doctest::
+
+            >>> x509.Name.from_bytes(
+            ...     b"0\x1a1\x180\x16\x06\x03U\x04\x03\x0c\x0fcryptography.io"
+            ... )
+            <Name(CN=cryptography.io)>
+
     .. classmethod:: from_rfc4514_string(data, attr_name_overrides=None)
 
         .. versionadded: 37.0.0
diff --git a/src/cryptography/hazmat/bindings/_rust/x509.pyi b/src/cryptography/hazmat/bindings/_rust/x509.pyi
@@ -39,6 +39,7 @@ def load_der_x509_csr(
     data: bytes, backend: typing.Any = None
 ) -> x509.CertificateSigningRequest: ...
 def encode_name_bytes(name: x509.Name) -> bytes: ...
+def parse_name_bytes(data: bytes) -> x509.Name: ...
 def encode_extension_value(extension: x509.ExtensionType) -> bytes: ...
 def create_x509_certificate(
     builder: x509.CertificateBuilder,
diff --git a/src/cryptography/x509/name.py b/src/cryptography/x509/name.py
@@ -320,6 +320,13 @@ def from_rfc4514_string(
     ) -> Name:
         return _RFC4514NameParser(data, attr_name_overrides or {}).parse()
 
+    @classmethod
+    def from_bytes(cls, data: bytes) -> Name:
+        """
+        Parse a DER encoded X.509 name (the inverse of ``public_bytes``).
+        """
+        return rust_x509.parse_name_bytes(data)
+
     def rfc4514_string(
         self, attr_name_overrides: _OidNameMap | None = None
     ) -> str:
diff --git a/src/rust/src/lib.rs b/src/rust/src/lib.rs
@@ -169,7 +169,7 @@ mod _rust {
             load_pem_x509_certificates, Certificate,
         };
         #[pymodule_export]
-        use crate::x509::common::{encode_extension_value, encode_name_bytes};
+        use crate::x509::common::{encode_extension_value, encode_name_bytes, parse_name_bytes};
         #[pymodule_export]
         use crate::x509::crl::{
             create_revoked_certificate, create_x509_crl, load_der_x509_crl, load_pem_x509_crl,
diff --git a/src/rust/src/x509/common.rs b/src/rust/src/x509/common.rs
@@ -120,6 +120,15 @@ pub(crate) fn encode_name_bytes<'p>(
     Ok(pyo3::types::PyBytes::new(py, &result))
 }
 
+#[pyo3::pyfunction]
+pub(crate) fn parse_name_bytes<'p>(
+    py: pyo3::Python<'p>,
+    data: &[u8],
+) -> CryptographyResult<pyo3::Bound<'p, pyo3::PyAny>> {
+    let name = asn1::parse_single::<NameReadable<'_>>(data)?;
+    parse_name(py, &name)
+}
+
 pub(crate) fn encode_general_names<'a>(
     py: pyo3::Python<'_>,
     ka_bytes: &'a cryptography_keepalive::KeepAlive<pyo3::pybacked::PyBackedBytes>,
diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py
@@ -6688,6 +6688,39 @@ def test_bytes(self, backend):
             b"b060355040a0c0450794341"
         )
 
+    def test_from_bytes(self):
+        data = binascii.unhexlify(
+            b"30293118301606035504030c0f63727970746f6772617068792e696f310d"
+            b"300b060355040a0c0450794341"
+        )
+        name = x509.Name.from_bytes(data)
+        assert name == x509.Name(
+            [
+                x509.NameAttribute(NameOID.COMMON_NAME, "cryptography.io"),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "PyCA"),
+            ]
+        )
+        assert name.public_bytes() == data
+
+    @pytest.mark.parametrize(
+        "data",
+        [
+            # Empty.
+            b"",
+            # Not valid DER.
+            b"\x00\x01\x02",
+            # Wrong tag (SET instead of SEQUENCE).
+            b"\x31\x00",
+            # Trailing data after the name.
+            binascii.unhexlify(b"300000"),
+            # RDN with a UTF8String value that is not valid UTF-8.
+            binascii.unhexlify(b"300c310a300806035504030c01ff"),
+        ],
+    )
+    def test_from_bytes_invalid(self, data):
+        with pytest.raises(ValueError):
+            x509.Name.from_bytes(data)
+
     def test_bitstring_encoding(self):
         name = x509.Name(
             [
