Why BER-TLV "DF9A" tag is recognized as "invalid"?

Question

I have problem with understanding why all the BER-TLV parsers I found:

• https://paymentcardtools.com/emv-tlv-parser
• https://emvlab.org/tlvutils/
• https://chrome.google.com/webstore/detail/tlv-parser/iemijfhdlipdpcjfnphcdalpccnkfedb

Recognize this tag: DF9A03001736 as "invalid", while: DF5603001736 and DF0903001736 work just fine.

What's the difference?

Answer 1

just follow the description provided in EMV Book 3, Annex B1

"invalid" case: DF9A03001736

DF - 1101 1111
9A - 1001 1010 - here, in the second byte of the Tag, the b8 is set (1), which means that 'Another byte follows', so the following byte (value 03) is also part of the Tag
03 - 0000 0011 - the last byte of the Tag, i.e. the actual Tag is DF9A03

so, in our sequence we have:

DF9A03 - Tag
00 - Length (no value)
17 - is already a new Tag
36 - length of the Tag 17 ... 

So the parser (https://paymentcardtools.com/emv-tlv-parser) fails because no data is available (Error during parsing Tag 17: Not enough data)

correct example: DF5603001736

DF - 1101 1111
56 - 0101 0110 - there are no more bytes that constitute Tag, so we just have Tag DF56

the sequence is:

DF56 - Tag
03 - Length
001736 - Value