# Asn1 der validate

`asn1-der-validate` · version 1.0.0 · Structured formats · free, no key needed

Check one ASN.1 DER value for canonical TLV structure and return a reason.

**Use when you need to: validate canonical der tlv encoding · check der hex for structural errors · is this der value canonical.**

## Decide before calling

Read the [versioned contract](/v1/tools/asn1-der-validate/versions/1.0.0) and the supported scope below. Reuse `asn1-der-validate@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `asn1-der-validate@1.0.0` for validate canonical der tlv encoding. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- validate canonical der tlv encoding
- check der hex for structural errors
- is this der value canonical
- reject nonminimal asn1 length forms
- der conformance check without a schema
- why a der encoding is not canonical
- בדיקת תקינות קידוד תגיות בלי סכמה

## Not supported

- validate an x509 certificate path or hostname
- check a signature, issuer, or expiry
- accept ber indefinite length as conformant

## Behavior

- Well-typed der_hex that is not one canonical DER value returns valid false and a snake_case reason. Wrong types, unknown fields, empty text, bad hex, and lone surrogates throw invalid_input. Over-limit input throws limit_exceeded before the walk.
- On success, reason is "ok" and the root summary describes the single top-level value. On failure, node_count and depth are 0 and the root fields are empty; byte_length is still the decoded input length.
- Rejection includes indefinite length, non-minimal tag or length, non-minimal INTEGER, BER BOOLEAN other than 0x00 or 0xff, bad BIT STRING padding, non-minimal OIDs, unsorted SET components, trailing bytes, and illegal constructed bits.
- REAL follows X.690 8.5 and 11.3. Empty contents are plus zero. 090100 is invalid_real because 0x00 is not a defined contents octet. Decimal, base 8/16, nonzero scale, an even mantissa, and a non-shortest exponent are real_not_canonical. Only special octets 0x40 and 0x41 are defined.
- UTCTime uses the RFC 5280 year window. The check does not interpret certificate semantics.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `der_hex` (string, required): min length 2; max length 512; pattern `^([0-9a-f]{2})+$`

## Output

- `valid` (boolean, required)
- `reason` (one of "ok", "truncated", "trailing_bytes", "indefinite_length", "non_minimal_length", "non_minimal_tag", "invalid_length", "invalid_tag", "reserved_tag", "invalid_constructed", "invalid_integer", "non_minimal_integer", "invalid_boolean", "invalid_null", "invalid_bit_string", "invalid_oid", "invalid_real", "real_not_canonical", "invalid_time", "invalid_utf8", "invalid_character_string", "invalid_bmp_string", "invalid_universal_string", "set_not_canonical", "invalid_der", required)
- `byte_length` (integer, required): min 0; max 256
- `node_count` (integer, required): min 0; max 32
- `depth` (integer, required): min 0; max 8
- `root_tag_class` (one of "", "universal", "application", "context", "private", required)
- `root_tag_number` (string, required): max length 600; pattern `^(|0|[1-9][0-9]{0,599})$`
- `root_constructed` (boolean, required)
- `root_universal_type` (one of "", "unknown", "boolean", "integer", "bit_string", "octet_string", "null", "object_identifier", "object_descriptor", "external", "real", "enumerated", "embedded_pdv", "utf8_string", "relative_oid", "time", "sequence", "set", "numeric_string", "printable_string", "teletex_string", "videotex_string", "ia5_string", "utc_time", "generalized_time", "graphic_string", "visible_string", "general_string", "universal_string", "character_string", "bmp_string", "date", "time_of_day", "date_time", "duration", "oid_iri", "relative_oid_iri", required)

## Limits

- max der bytes: 256
- max depth: 8
- max nodes: 32
- max output bytes: 16384
- max tag decimal digits: 600
- max hex chars: 512

## Example

Request input:

```json
{
  "der_hex": "300d06096086480165030402010500"
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "reason": "ok",
    "byte_length": 15,
    "node_count": 3,
    "depth": 2,
    "root_tag_class": "universal",
    "root_tag_number": "16",
    "root_constructed": true,
    "root_universal_type": "sequence"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "asn1-der-validate",
  "version": "1.0.0",
  "input": {
    "der_hex": "300d06096086480165030402010500"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/asn1-der-validate/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"der_hex":"300d06096086480165030402010500"}'
```

The machine-readable contract is at [/v1/tools/asn1-der-validate/versions/1.0.0](/v1/tools/asn1-der-validate/versions/1.0.0).

### CLI

```sh
node cli.mjs run asn1-der-validate 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Asn1 der parse](/tools/asn1-der-parse): Parse one ASN.1 DER value into a flat schema-free TLV node list.
- [Asn1 der encode tree](/tools/asn1-der-encode-tree): Encode a schema-free ASN.1 node list as one canonical DER value.
- [Asn1 der path list](/tools/asn1-der-path-list): List numeric paths, offsets, lengths, and tag class for every node in one DER value.
- [Asn1 der node extract](/tools/asn1-der-node-extract): Extract one DER node by a numeric path, with header, content, and child paths.
- [Asn1 der primitive decode](/tools/asn1-der-primitive-decode): Decode one universal DER primitive from lowercase hex into typed fields.
- [Asn1 der primitive encode](/tools/asn1-der-primitive-encode): Encode one universal DER primitive from typed fields into lowercase hex.