# Asn1 der parse

`asn1-der-parse` · version 1.0.0 · Structured formats · free, no key needed

Parse one ASN.1 DER value into a flat schema-free TLV node list.

**Use when you need to: parse asn1 der tlv tree · decode distinguished encoding into nodes · der hex to schema free node list.**

## Decide before calling

Read the [versioned contract](/v1/tools/asn1-der-parse/versions/1.0.0) and the supported scope below. Reuse `asn1-der-parse@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `asn1-der-parse@1.0.0` for parse asn1 der tlv tree. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- parse asn1 der tlv tree
- decode distinguished encoding into nodes
- der hex to schema free node list
- read asn1 tag length and value
- split one der value into tlvs
- universal type of a der encoding
- פענוח מבנה תגיות אסן אחד לעץ שטוח

## Not supported

- verify a signature carried inside the encoding
- accept ber indefinite length or non-canonical contents
- parse a pem certificate chain

## Behavior

- Input der_hex is one lowercase even-length hex encoding of exactly one DER value. Trailing bytes are rejected.
- The node list is a preorder walk. Index 0 is the root, parent -1. child_indexes point at later nodes. content_hex is the contents octets only; header_hex is the tag and definite length.
- Universal types with DER content rules are checked, including BOOLEAN 0x00/0xff, minimal two's-complement INTEGER and ENUMERATED, primitive BIT STRING with zero padding, NULL, minimal OIDs, and REAL under X.690 8.5 and 11.3.
- REAL plus zero is empty contents and value_text "0". +INF is "INF", -INF is "-INF". A finite canonical value is "<mantissa>*2^<exponent>" with an odd mantissa, base 2 and scaling factor 0. 0x00, decimal encodings, base 8/16, a nonzero scale, an even mantissa, and a non-shortest exponent are rejected. 0x42 and 0x43 are reserved.
- UTCTime must be YYMMDDHHMMSSZ, with years 00-49 read as 2000-2049 and 50-99 as 1950-1999 (RFC 5280). GeneralizedTime must be YYYYMMDDHHMMSS[.fraction]Z with no trailing zero in the fraction.
- SET components must already be in ascending raw DER order. SEQUENCE order is preserved. Unknown and non-universal tags are kept structurally. Tag 0 and tag 15 are reserved.
- Large integers, OID arcs and REAL mantissas are decimal strings. No floating-point value is returned.
- Limits are enforced before a full walk: 512 hex characters, 256 decoded bytes, depth 8, 32 nodes, 600 tag digits, and 16384 UTF-8 bytes of JSON output.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `der_hex` (string, required): min length 2; max length 512; pattern `^([0-9a-f]{2})+$`

## Output

- `der_hex` (string, required): min length 4; max length 512; pattern `^([0-9a-f]{2})+$`
- `byte_length` (integer, required): min 2; max 256
- `node_count` (integer, required): min 1; max 32
- `depth` (integer, required): min 1; max 8
- `nodes` (array of object, required): min items 1; max items 32

## Limits

- max der bytes: 256
- max depth: 8
- max nodes: 32
- max output bytes: 16384
- max tag decimal digits: 600
- max hex chars: 512

## Example

Request input:

```json
{
  "der_hex": "0500"
}
```

Response:

```json
{
  "result": {
    "der_hex": "0500",
    "byte_length": 2,
    "node_count": 1,
    "depth": 1,
    "nodes": [
      {
        "index": 0,
        "parent": -1,
        "depth": 1,
        "offset": 0,
        "tag_class": "universal",
        "tag_number": "5",
        "constructed": false,
        "header_hex": "0500",
        "content_hex": "",
        "der_hex": "0500",
        "universal_type": "null",
        "value_kind": "null",
        "value_text": "",
        "child_indexes": []
      }
    ]
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "asn1-der-parse",
  "version": "1.0.0",
  "input": {
    "der_hex": "0500"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/asn1-der-parse/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"der_hex":"0500"}'
```

The machine-readable contract is at [/v1/tools/asn1-der-parse/versions/1.0.0](/v1/tools/asn1-der-parse/versions/1.0.0).

### CLI

```sh
node cli.mjs run asn1-der-parse 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Asn1 der encode tree](/tools/asn1-der-encode-tree): Encode a schema-free ASN.1 node list as one canonical DER value.
- [Asn1 der path list](/tools/asn1-der-path-list): List numeric paths, offsets, lengths, and tag class for every node in one DER value.
- [Asn1 der primitive decode](/tools/asn1-der-primitive-decode): Decode one universal DER primitive from lowercase hex into typed fields.
- [Asn1 der node extract](/tools/asn1-der-node-extract): Extract one DER node by a numeric path, with header, content, and child paths.
- [Asn1 der primitive encode](/tools/asn1-der-primitive-encode): Encode one universal DER primitive from typed fields into lowercase hex.
- [Asn1 der validate](/tools/asn1-der-validate): Check one ASN.1 DER value for canonical TLV structure and return a reason.