moonD4rk/HackBrowserData · error

failed to decode ASN1 data

Error message

failed to decode ASN1 data

What it means

errDecodeASN1 is returned by NewASN1PBE when the input bytes cannot be parsed as the expected ASN.1 DER PBE structure. It indicates the blob is not valid DER of the expected shape, so no PBE object can be constructed.

Source

Thrown at crypto/errors.go:13

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Confirm the input is the NSS ASN.1 encrypted item (from key4.db metadata or the encrypted login value), not raw plaintext.
2. Dump the first bytes of the blob (should look like a DER SEQUENCE, e.g. 0x30...) and validate DER before calling.
3. Re-copy the Firefox profile files to rule out truncation.
4. Check you are not cross-feeding Chromium-format data into the PBE parser.

Example fix

// before
pbe, err := crypto.NewASN1PBE(someRawValue)
// after
if len(someRawValue) == 0 || someRawValue[0] != 0x30 {
    return fmt.Errorf("not ASN.1 DER (first byte 0x%02X)", someRawValue[0])
}
pbe, err := crypto.NewASN1PBE(someRawValue)

func looksLikeDER(b []byte) bool { return len(b) > 2 && b[0] == 0x30 }

func isASN1Sequence(b []byte) bool { return len(b) >= 2 && b[0] == 0x30 }

pbe, err := crypto.NewASN1PBE(data)
if errors.Is(err, crypto.ErrDecodeASN1) {
    return fmt.Errorf("not a valid PBE blob: %w", err)
}

When it happens

Trigger: Calling NewASN1PBE with arbitrary bytes (e.g. []byte{0xFF,0xFF}), a truncated key blob, or a value read from the wrong Firefox field (plaintext instead of the ASN.1 encrypted item).

Common situations: Pointing the extractor at the wrong Firefox column/JSON field; corrupted key4.db/logins.json content; passing base64 of something that is not NSS ASN.1; feeding a Chromium blob into the PBE path.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unsupported IV length
• yandex: v10 marker not found in local_encryptor_data
• ciphertext too short
• ciphertext is not a multiple of the block size
• invalid PKCS5 padding

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/d9e81cebea9b011d. Report an issue: GitHub.