{"record":{"id":"c8779a8040c0297b","repo":"golang/go","slug":"invalid-asn-1","errorCode":null,"errorMessage":"invalid ASN.1","messagePattern":"invalid ASN\\.1","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/ecdsa/ecdsa.go","lineNumber":560,"sourceCode":"\tk, err := publicKeyToFIPS(c, pub)\n\tif err != nil {\n\t\treturn false\n\t}\n\tif err := ecdsa.Verify(c, k, hash, &ecdsa.Signature{R: r, S: s}); err != nil {\n\t\treturn false\n\t}\n\treturn true\n}\n\nfunc parseSignature(sig []byte) (r, s []byte, err error) {\n\tvar inner cryptobyte.String\n\tinput := cryptobyte.String(sig)\n\tif !input.ReadASN1(&inner, asn1.SEQUENCE) ||\n\t\t!input.Empty() ||\n\t\t!inner.ReadASN1Integer(&r) ||\n\t\t!inner.ReadASN1Integer(&s) ||\n\t\t!inner.Empty() {\n\t\treturn nil, nil, errors.New(\"invalid ASN.1\")\n\t}\n\treturn r, s, nil\n}\n\nfunc publicKeyFromFIPS(curve elliptic.Curve, pub *ecdsa.PublicKey) (*PublicKey, error) {\n\tx, y, err := pointToAffine(curve, pub.Bytes())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &PublicKey{Curve: curve, X: x, Y: y}, nil\n}\n\nfunc privateKeyFromFIPS(curve elliptic.Curve, priv *ecdsa.PrivateKey) (*PrivateKey, error) {\n\tpub, err := publicKeyFromFIPS(curve, priv.PublicKey())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &PrivateKey{PublicKey: *pub, D: new(big.Int).SetBytes(priv.Bytes())}, nil","sourceCodeStart":542,"sourceCodeEnd":578,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/ecdsa/ecdsa.go#L542-L578","documentation":"Thrown by parseSignature when the input byte slice is not a valid ASN.1 SEQUENCE containing exactly two INTEGERs (r, s) with no trailing data. This is the standard ECDSA signature format (DER-encoded ASN.1). Any structural violation — wrong tags, incorrect lengths, extra or missing fields — produces this error.","triggerScenarios":"Calling VerifyASN1 or any function that internally calls parseSignature with a malformed signature byte slice. Triggers include: passing raw r||s concatenated bytes instead of DER, truncated or corrupted DER, ASN.1 with negative integers (non-minimal encoding), or DER with extra trailing bytes after the SEQUENCE.","commonSituations":"Interoperability between systems that use different signature encodings (concatenated r,s vs DER); corrupted signature data from network transmission; signatures produced by non-standard libraries that don't follow strict DER; passing hex strings instead of decoded bytes.","solutions":["Ensure the signature is DER-encoded ASN.1 (produced by SignASN1 or compatible library) — if you have raw r,s values, use Sign/Verify with big.Int instead of ASN.1 variants.","Verify the signature bytes are not corrupted: check length, first byte should be 0x30 (SEQUENCE tag).","If interoperating with a system that uses IEEE P1363 format (fixed-width r||s), convert to DER before passing to ASN.1 functions."],"exampleFix":"// before\n// sigBytes is raw r||s concatenated (IEEE P1363 format)\nok := ecdsa.VerifyASN1(pub, hash, sigBytes)\n\n// after\n// convert P1363 to DER, or use VerifyASN1 with a properly DER-encoded signature\n// generated by ecdsa.SignASN1","handlingStrategy":"validation","validationCode":"func isValidASN1Signature(sig []byte) bool {\n    s := cryptobyte.String(sig)\n    var inner cryptobyte.String\n    var r, ss big.Int\n    return s.ReadASN1(&inner, asn1.SEQUENCE) && s.Empty() &&\n        inner.ReadASN1Integer(&r) && inner.ReadASN1Integer(&ss) && inner.Empty()\n}","typeGuard":"func isDERSignature(sig []byte) bool {\n    return len(sig) > 0 && sig[0] == 0x30 // ASN.1 SEQUENCE tag\n}","tryCatchPattern":"ok := ecdsa.VerifyASN1(pub, hash, sig)\nif !ok {\n    if !isDERSignature(sig) {\n        // signature may be in IEEE P1363 (r||s) format — convert to DER\n        return errors.New(\"signature not in DER format\")\n    }\n    return errors.New(\"signature verification failed\")\n}","preventionTips":["Use SignASN1 to produce signatures — they are always valid DER.","When interoperating with P1363-format signatures, convert before calling VerifyASN1.","Check sig[0] == 0x30 as a quick sanity check for DER SEQUENCE."],"tags":["crypto","ecdsa","asn1","signature","encoding","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}