Asn1 der validate

asn1-der-validate · version 1.0.0 · Structured formats · free, no key needed

Check one ASN.1 DER value for canonical TLV structure and return a reason.

Use when you need to: validate canonical der tlv encoding · check der hex for structural errors · is this der value canonical.

Decide before calling

Read the versioned contract and the supported scope below. Reuse asn1-der-validate@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use asn1-der-validate@1.0.0 for validate canonical der tlv encoding. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• validate canonical der tlv encoding
• check der hex for structural errors
• is this der value canonical
• reject nonminimal asn1 length forms
• der conformance check without a schema
• why a der encoding is not canonical
• בדיקת תקינות קידוד תגיות בלי סכמה

Not supported

• validate an x509 certificate path or hostname
• check a signature, issuer, or expiry
• accept ber indefinite length as conformant

Behavior

• Well-typed der_hex that is not one canonical DER value returns valid false and a snake_case reason. Wrong types, unknown fields, empty text, bad hex, and lone surrogates throw invalid_input. Over-limit input throws limit_exceeded before the walk.
• On success, reason is "ok" and the root summary describes the single top-level value. On failure, node_count and depth are 0 and the root fields are empty; byte_length is still the decoded input length.
• Rejection includes indefinite length, non-minimal tag or length, non-minimal INTEGER, BER BOOLEAN other than 0x00 or 0xff, bad BIT STRING padding, non-minimal OIDs, unsorted SET components, trailing bytes, and illegal constructed bits.
• REAL follows X.690 8.5 and 11.3. Empty contents are plus zero. 090100 is invalid_real because 0x00 is not a defined contents octet. Decimal, base 8/16, nonzero scale, an even mantissa, and a non-shortest exponent are real_not_canonical. Only special octets 0x40 and 0x41 are defined.
• UTCTime uses the RFC 5280 year window. The check does not interpret certificate semantics.
• Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

Input

• der_hex (string, required): min length 2; max length 512; pattern ^([0-9a-f]{2})+$

Output

• valid (boolean, required)
• reason (one of "ok", "truncated", "trailing_bytes", "indefinite_length", "non_minimal_length", "non_minimal_tag", "invalid_length", "invalid_tag", "reserved_tag", "invalid_constructed", "invalid_integer", "non_minimal_integer", "invalid_boolean", "invalid_null", "invalid_bit_string", "invalid_oid", "invalid_real", "real_not_canonical", "invalid_time", "invalid_utf8", "invalid_character_string", "invalid_bmp_string", "invalid_universal_string", "set_not_canonical", "invalid_der", required)
• byte_length (integer, required): min 0; max 256
• node_count (integer, required): min 0; max 32
• depth (integer, required): min 0; max 8
• root_tag_class (one of "", "universal", "application", "context", "private", required)
• root_tag_number (string, required): max length 600; pattern ^(|0|[1-9][0-9]{0,599})$
• root_constructed (boolean, required)
• root_universal_type (one of "", "unknown", "boolean", "integer", "bit_string", "octet_string", "null", "object_identifier", "object_descriptor", "external", "real", "enumerated", "embedded_pdv", "utf8_string", "relative_oid", "time", "sequence", "set", "numeric_string", "printable_string", "teletex_string", "videotex_string", "ia5_string", "utc_time", "generalized_time", "graphic_string", "visible_string", "general_string", "universal_string", "character_string", "bmp_string", "date", "time_of_day", "date_time", "duration", "oid_iri", "relative_oid_iri", required)

Limits

• max der bytes: 256
• max depth: 8
• max nodes: 32
• max output bytes: 16384
• max tag decimal digits: 600
• max hex chars: 512

Example

Request input:

{
  "der_hex": "300d06096086480165030402010500"
}

Response:

{
  "result": {
    "valid": true,
    "reason": "ok",
    "byte_length": 15,
    "node_count": 3,
    "depth": 2,
    "root_tag_class": "universal",
    "root_tag_number": "16",
    "root_constructed": true,
    "root_universal_type": "sequence"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "asn1-der-validate",
  "version": "1.0.0",
  "input": {
    "der_hex": "300d06096086480165030402010500"
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/asn1-der-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"der_hex":"300d06096086480165030402010500"}'

The machine-readable contract is at /v1/tools/asn1-der-validate/versions/1.0.0.

CLI

node cli.mjs run asn1-der-validate 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Asn1 der parse: Parse one ASN.1 DER value into a flat schema-free TLV node list.
• Asn1 der encode tree: Encode a schema-free ASN.1 node list as one canonical DER value.
• Asn1 der path list: List numeric paths, offsets, lengths, and tag class for every node in one DER value.
• Asn1 der node extract: Extract one DER node by a numeric path, with header, content, and child paths.
• Asn1 der primitive decode: Decode one universal DER primitive from lowercase hex into typed fields.
• Asn1 der primitive encode: Encode one universal DER primitive from typed fields into lowercase hex.