1

My ASN.1 decoder was working fine up until I faced an interesting type:

0x80 which was decoded by online tools as a simple type with name [0].

I found some sources mentioning this to be "indefinite length", but it definitely had a definite length which I could read. What actually is this type and are there other types like that?

karolyzz
  • 480
  • 4
  • 28
  • 1
    It depends on where `0x80` is presented in a TLV structure. If this value is presented in type (tag), it is type selector (choice). If this value is presented in length, then it denotes indefinite length. Can you clarify? – Crypt32 Aug 27 '18 at 11:23
  • @Crypt32 Yes, it is a type (tag), sorry if i was unclear – karolyzz Aug 27 '18 at 11:38
  • Then this is implicit type selector (choice) without outer type and underlying data type is simple type. – Crypt32 Aug 27 '18 at 11:57
  • @Crypt32 is it what was described [in this answer](https://stackoverflow.com/a/30608283/7343355)? – karolyzz Aug 27 '18 at 13:13

1 Answers1

3

As a tag, 0x80 (under BER, CER, or DER) means a tag whose class is context-specific (vs the named classes, UNIVERSAL, PRIVATE, and APPLICATION), whose number is 0, and whose encoding is primitive. The fact that it is primitive means it is being used as an IMPLICIT tag. Had it been 0xA0 (Constructed, Context-Specific 0) it could be either an EXPLICIT tag (a wrapper) or an IMPLICIT constructed value (SEQUENCE, SEQUENCE-OF, etc).

Knowing what such a value means require looking at the ASN.1 type definition.

For example, from RFC 3280 A.2 (DEFINITIONS IMPLICIT TAGS):

PrivateKeyUsagePeriod ::= SEQUENCE {
     notBefore       [0]     GeneralizedTime OPTIONAL,
     notAfter        [1]     GeneralizedTime OPTIONAL }

If a PrivateKeyUsagePeriod had a notBefore value then it would be tagged with 0x80 ([0]) instead of 0x18 ([UNIVERSAL 24]); but it should still be interpreted following the encoding for GeneralizedTime.

Community
  • 1
  • 1
bartonjs
  • 30,352
  • 2
  • 71
  • 111
  • Thanks. Just to clarify the part "whose number is 0" - does this mean that [1] would be 0x81? – karolyzz Aug 27 '18 at 14:29
  • 1
    @karolyzz Yep. [X.690](https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.690-201508-I!!PDF-E&type=items) section 8.1.2 ("Identifier octets") – bartonjs Aug 27 '18 at 14:31