# Asn1 der primitive decode

`asn1-der-primitive-decode` · version 1.0.0 · Structured formats · free, no key needed

Decode one universal DER primitive from lowercase hex into typed fields.

**Use when you need to: decode one der primitive value · parse an asn.1 universal tlv · read der boolean integer and null.**

## Decide before calling

Read the [versioned contract](/v1/tools/asn1-der-primitive-decode/versions/1.0.0) and the supported scope below. Reuse `asn1-der-primitive-decode@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `asn1-der-primitive-decode@1.0.0` for decode one der primitive value. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- decode one der primitive value
- parse an asn.1 universal tlv
- read der boolean integer and null
- decode der bit string and octet string
- decode der utctime or generalizedtime
- read arcs from an object identifier tlv
- lowercase der hex into typed fields
- פענוח ערך פרימיטיבי אחד

## Not supported

- encode a typed value to der
- parse x.680 object identifier brace notation
- constructed, indefinite, or application-tagged values
- verify a signature or a certificate

## Behavior

- Input is lowercase even hex of exactly one primitive TLV. Integers come back as canonical decimal strings. Every octet string is lowercase hex.
- Selected universal tags only: BOOLEAN, INTEGER, BIT STRING, OCTET STRING, NULL, OBJECT IDENTIFIER, UTF8String, NumericString, PrintableString, IA5String, UTCTime, GeneralizedTime, and VisibleString.
- DER rules: definite minimal length, primitive form, BOOLEAN 00 or ff, minimal two's-complement INTEGER, BIT STRING unused bits zero, OBJECT IDENTIFIER base-128 with no leading 80, and the X.690 11.7/11.8 time subset (Z and seconds required, no comma, no trailing zero in a fraction).
- There is no separate OBJECT IDENTIFIER arc-count cap and no arc-digit cap. Arc count and magnitude are bounded only by the contents that fit in max_der_bytes.
- der_hex longer than 512 characters, or whose UTF-8 form exceeds 512 bytes, is limit_exceeded before the hex alphabet is checked. That budget is 256 DER bytes.
- Constructed encodings, indefinite length, non-minimal length or tags, trailing octets, and non-canonical contents are invalid_input. A well-formed non-universal class, a tag number above 30, or a universal tag outside the selected set is unsupported_input.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `der_hex` (string, required): min length 2; max length 512; pattern `^(?:[0-9a-f]{2})*$`

## Output

- `tag` (integer, required): min 1; max 30
- `type_name` (one of "boolean", "integer", "bit_string", "octet_string", "null", "object_identifier", "utf8_string", "numeric_string", "printable_string", "ia5_string", "utc_time", "generalized_time", "visible_string", required)
- `der_hex` (string, required): min length 2; max length 512; pattern `^(?:[0-9a-f]{2})*$`
- `content_hex` (string, required): max length 512; pattern `^(?:[0-9a-f]{2})*$`
- `boolean` (boolean, optional)
- `integer` (string, optional): min length 1; max length 700; pattern `^(0|-?[1-9][0-9]*)$`
- `unused_bits` (integer, optional): min 0; max 7
- `payload_hex` (string, optional): max length 512; pattern `^(?:[0-9a-f]{2})*$`
- `arcs` (array of string, optional): min items 2; max items 256; each min length 1; each max length 600; each pattern `^(0|[1-9][0-9]*)$`
- `dotted` (string, optional): min length 3; max length 2048
- `text` (string, optional): max length 256

## Limits

- max der bytes: 256

## Example

Request input:

```json
{
  "der_hex": "0500"
}
```

Response:

```json
{
  "result": {
    "tag": 5,
    "type_name": "null",
    "der_hex": "0500",
    "content_hex": ""
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "asn1-der-primitive-decode",
  "version": "1.0.0",
  "input": {
    "der_hex": "0500"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/asn1-der-primitive-decode/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"der_hex":"0500"}'
```

The machine-readable contract is at [/v1/tools/asn1-der-primitive-decode/versions/1.0.0](/v1/tools/asn1-der-primitive-decode/versions/1.0.0).

### CLI

```sh
node cli.mjs run asn1-der-primitive-decode 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Asn1 der primitive encode](/tools/asn1-der-primitive-encode): Encode one universal DER primitive from typed fields into lowercase hex.
- [Asn1 der parse](/tools/asn1-der-parse): Parse one ASN.1 DER value into a flat schema-free TLV node list.
- [Asn1 der encode tree](/tools/asn1-der-encode-tree): Encode a schema-free ASN.1 node list as one canonical DER value.
- [Asn1 der node extract](/tools/asn1-der-node-extract): Extract one DER node by a numeric path, with header, content, and child paths.
- [Toml10 parse](/tools/toml10-parse): Parse TOML 1.0 into typed nodes with exact int64, floats, and datetimes.
- [Xpath10 evaluate](/tools/xpath10-evaluate): Evaluate an XPath 1.0 value expression and return its type with an exact string, number, or boolean token.