nx_asn1.nx

asn1.nx -- ASN.1 DER TLV (Tag-Length-Value) primitives. Distinguished Encoding Rules (ITU-T X.690) reader. DER is the canonical form every X.509 cert uses, every TLS signature, every PKCS#8 key, every CMS message. We implement a reader-only subset -- write-side encoders are future work. DER structure: TLV byte sequence: - Tag: 1-N bytes. Low-tag-number form: 1 byte encoding class (bits 7-6), constructed flag (bit 5), tag (bits 4-0). High-tag-number form (tag >= 31): bits 4-0 = 0x1F, then tag in base-128 continuation bytes. X.509 uses low form exclusively in practice; we support both. - Length: 1-N bytes. Short form (0-127): single byte. Long form: byte 0x80+n indicates n bytes of length follow, big-endian. n <= 126; indefinite-length form (0x80) is explicitly forbidden in DER. - Value: length bytes, content depends on tag. Tags relevant to X.509: 0x02 INTEGER 0x03 BIT STRING 0x04 OCTET STRING 0x05 NULL 0x06 OBJECT IDENTIFIER 0x0C UTF8String 0x13 PrintableString 0x17 UTCTime 0x18 GeneralizedTime 0x30 SEQUENCE (constructed) 0x31 SET (constructed) 0xA0-0xA7 context-specific [0]..[7] Invariants: A1 All reads bounds-check against the caller-supplied length. Negative return signals either "invalid input" (malformed DER) or "out of bounds" (read would exceed buffer). A2 Length field rejects indefinite-length form (DER forbids). A3 No recursion; callers drive descent explicitly.