Re: [Acme] ACME signature mechanics

[Richard Barnes <[e-mail]>]

On Sun, Dec 7, 2014 at 11:15 PM, Manger, James <
[e-mail]> wrote:

> 2. Appending ‘path’ to ‘.well-known/acme-challenge’ as part of a
> simpleHttps challenge (section 6.1) looks dangerous if not done carefully.
> What if ‘path’ is “../../user/alice/whatever”?
>
>
>
> Suggestion: I would be tempted to say: “take the ‘path’ string value,
> UTF-8 encode it, base64url-encode those bytes, then append to
> ‘.well-known/acme-challenge’”.
>
>
>
> > Good point.  It seems like a simpler solution would just be to require
> that the "path" value meet a certain ABNF, e.g., the URL-safe base64
> alphabet.  The only reason that the client provides the path is to let it
> avoid collisions if it has multiple validations in progress, so there's not
> a need for it to be especially expressive.
>
>
>
> That might be simpler, but it relies on clients doing input validation on
> ‘path’. Telling the client to B64 whatever it gets might be just a smidgen
> safer.
>

Relies on *servers* doing input validation; the client chooses the path.
And if the server isn't validating its inputs, we have bigger problems :)
Since not checking other inputs can lead to the issuance of bad certs.

--Richard



> --
>
> James Manger
>