{"record":{"id":"d9e81cebea9b011d","repo":"moonD4rk/HackBrowserData","slug":"failed-to-decode-asn1-data","errorCode":null,"errorMessage":"failed to decode ASN1 data","messagePattern":"failed to decode ASN1 data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crypto/errors.go","lineNumber":13,"sourceCode":"package crypto\n\nimport \"errors\"\n\n// Sentinel errors for crypto operations.\nvar (\n\terrShortCiphertext   = errors.New(\"ciphertext too short\")\n\terrInvalidBlockSize  = errors.New(\"ciphertext is not a multiple of the block size\")\n\terrInvalidIVLength   = errors.New(\"IV length must equal block size\")\n\terrInvalidPadding    = errors.New(\"invalid PKCS5 padding\")\n\terrInvalidNonceLen   = errors.New(\"nonce length must equal GCM nonce size\")\n\terrUnsupportedIVLen  = errors.New(\"unsupported IV length\")\n\terrDecodeASN1        = errors.New(\"failed to decode ASN1 data\")\n\terrDPAPINotSupported = errors.New(\"DPAPI not supported on this platform\") //nolint:unused // used on darwin/linux only\n)\n","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/crypto/errors.go#L1-L16","documentation":"errDecodeASN1 is returned by NewASN1PBE when the input bytes cannot be parsed as the expected ASN.1 DER PBE structure. It indicates the blob is not valid DER of the expected shape, so no PBE object can be constructed.","triggerScenarios":"Calling NewASN1PBE with arbitrary bytes (e.g. []byte{0xFF,0xFF}), a truncated key blob, or a value read from the wrong Firefox field (plaintext instead of the ASN.1 encrypted item).","commonSituations":"Pointing the extractor at the wrong Firefox column/JSON field; corrupted key4.db/logins.json content; passing base64 of something that is not NSS ASN.1; feeding a Chromium blob into the PBE path.","solutions":["Confirm the input is the NSS ASN.1 encrypted item (from key4.db metadata or the encrypted login value), not raw plaintext.","Dump the first bytes of the blob (should look like a DER SEQUENCE, e.g. 0x30...) and validate DER before calling.","Re-copy the Firefox profile files to rule out truncation.","Check you are not cross-feeding Chromium-format data into the PBE parser."],"exampleFix":"// before\npbe, err := crypto.NewASN1PBE(someRawValue)\n// after\nif len(someRawValue) == 0 || someRawValue[0] != 0x30 {\n    return fmt.Errorf(\"not ASN.1 DER (first byte 0x%02X)\", someRawValue[0])\n}\npbe, err := crypto.NewASN1PBE(someRawValue)","handlingStrategy":"validation","validationCode":"func looksLikeDER(b []byte) bool { return len(b) > 2 && b[0] == 0x30 }","typeGuard":"func isASN1Sequence(b []byte) bool { return len(b) >= 2 && b[0] == 0x30 }","tryCatchPattern":"pbe, err := crypto.NewASN1PBE(data)\nif errors.Is(err, crypto.ErrDecodeASN1) {\n    return fmt.Errorf(\"not a valid PBE blob: %w\", err)\n}","preventionTips":["Confirm the source field is the ASN.1-encrypted NSS item, not plaintext.","Sanity-check the first byte is 0x30 (DER SEQUENCE) before parsing.","Re-copy Firefox profile files if reads may be torn.","Don't feed Chromium-format blobs into the Firefox PBE parser."],"tags":["crypto","asn1","der","firefox","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}