0

I have a problem decoding this TLV

Template Tag (7001) 2 bytes

Length Tag (0020) 2 bytes

Value is another TLV

Tag(e101) Length (000f) Value(373834313938353338353236313430)

Tag(e102) Length (0009) Value(0009303931383631393038)

70010020e101000f373834313938353338353236313430e1020009303931383631393038

when I try any TLV decoder it read the Template tag as 1 byte only and then the rest will be missed up. can you please advice on how to parse it? by the way, I receive the data as Base64String then I convert to HEX

Hassan Abu Helweh
  • 3
  • 3
  • You don't mention any specific TLV decoder, but your interpretation of LENGTH is flawed. If a length field is present, either the first byte is < 7F, then it represents the direct length or 8x, then x encodes the number of follow-up bytes encoding the length. `0020` would be interpreted as 00, and the 20 as the next tag. For details, see ISO 7816, part 4. – guidot Feb 21 '21 at 22:18
  • This was probably written by someone, who wanted to write something similar to TLV, but had no proper knowledge of the rules. Therefore the format seems proprietary and i don't you will find a suitable parser – Paul Bastian Feb 22 '21 at 15:14
  • 3
    This question is tagged with asn.1. In ASN.1 BER (ITU-T X.690), 0x70 indicates an Application, constructed tag of 16. So the tag would indeed be 1 byte. The data is either wrong (if you expect something else), or is not X.690 BER data, or you are interpreting it incorrectly yourself. – Kevin Feb 22 '21 at 16:22

1 Answers1

2

A BER decoder interprets this TLV stream as follows:

byte 1,     byte 2,     byte 3,     byte 4 
T=01110000, L=00000001, V=00000000, <end> 
                          ^ inner TLV, starts with T=0 and no place for LV
              ^ length of the V is 1 byte (!!! this why it ends prematurely !!!)
     ^ 10000=SEQUENCE or SEQUENCE OF tag 16
    ^ 1=constructed tag
  ^ 01=APPLICATION tag
AKha
  • 107
  • 1
  • 4