Forensics tools

Parse Object Identifier

Decode a raw ASN.1 OBJECT IDENTIFIER byte string (tag and length already stripped) into dotted-decimal form.

Runs on your device. The file is never uploaded.

Parse Object Identifier turns the raw content bytes of an ASN.1 OBJECT IDENTIFIER into dotted-decimal form, naming the value when it knows it. The first byte packs two arcs as 40 times one plus the other, and the rest are base-128. Almost any non-empty input decodes to something, so a wrong answer looks exactly like a right one.

Input

Questions

What input does this expect?

The raw content bytes of an OBJECT IDENTIFIER, with the tag and length already stripped. That is the value of a 0x06 tag pulled out of an ASN.1 structure, not the whole TLV. If you feed it a complete TLV, the leading 06 and length byte are decoded as arcs and you get a wrong answer. The refusal message spells this out when the decode fails.

How is the number decoded?

The first byte carries the first two arcs, packed as 40 times the first plus the second, which is why an OID starting 1.2 begins with byte 0x2a. Every byte after that is base-128 with the high bit marking continuation. The result is joined with dots. Then it is looked up in a small table of common identifiers and the name is printed in brackets when there is one.

Why does it say my OID is not in the known table?

Because the table holds the identifiers that turn up constantly in certificates and PKCS blobs, such as rsaEncryption, ecdsaWithSHA256, prime256v1, Ed25519, commonName, keyUsage, subjectAltName and basicConstraints. It is not the full registry, which runs to tens of thousands of entries. The dotted number is still correct; look it up in a public OID registry if you need the name.

Why did I get a number that looks wrong instead of an error?

Because almost any non-empty byte string decodes into some dotted string. The decoder rejects only an empty input, and an empty file is caught earlier still with "empty file". So garbage in gives a plausible-looking OID out. Confirm the bytes were a 0x06 value by looking at the structure in Parse ASN.1 first.

How do I get the OID bytes out of a certificate?

Run Parse ASN.1 on the DER, which decodes and names every OBJECT IDENTIFIER inline, so you usually never need this tool for a certificate. This one is for the case where you already have loose bytes: an OID copied out of a protocol capture, a database field, or a structure your parser choked on.

Related Forensics tools