Re: [pkix] Signature Verification and DER requirements

[Jeffrey Walton <[e-mail]>]

On Fri, May 15, 2015 at 10:12 AM, Erik Andersen <[e-mail]> wrote:
> As Peter states. It is confusing, and I am not sure how to get it right.
>
> ...
> I am interested in comments.
>
Maybe the easiest course is to side-step the issue altogether. The
issue here is verification, so focus on it.

Leave things the way they are related to encoding the certificate and
signing the certificate (or more correctly, tbsCertificate).

Then be explicit about how to verify it. That is, explicitly state
bits should be verified as they are received; and they should not be
rearranged to comply with anything because that will usually (always?)
invalidate the signature.

Allowing the bits to be rearranged during verification just seems
wrong. It effectively creates a potential for a DoS when there's no
need for one to exist. The security goals were met earlier, when the
identity was bound to the public key.

I also think you should give an implementation a choice during
verification: they can choose to reject a non-DER encoded certificate
because that's how things are written. But they should reject for the
proper reason: reject because its no-DER encoded; and not becuase they
re-arranged bits that caused a signature failure.

Allowing a receiver to rearrange bits and then claim the signature
verification failed is just plain wrong. They may as well have
performed 'certificate[0] XOR 0x01' and claimed the certificate was
tampered. There's no difference.

Jeff