IETF Logo Mail Archive

Re: [TLS] Verifying X.509 Certificate Chains out of order

pgut001@cs.auckland.ac.nz (Peter Gutmann) Mon, 06 October 2008 09:44 UTC

Return-Path: <tls-bounces@ietf.org>
X-Original-To: tls-archive@ietf.org
Delivered-To: ietfarch-tls-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D86FD3A6A8E; Mon, 6 Oct 2008 02:44:20 -0700 (PDT)
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A013B3A6A95 for <tls@core3.amsl.com>; Mon, 6 Oct 2008 02:44:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.099
X-Spam-Level:
X-Spam-Status: No, score=-5.099 tagged_above=-999 required=5 tests=[AWL=1.500, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJk69c+PKYtg for <tls@core3.amsl.com>; Mon, 6 Oct 2008 02:44:18 -0700 (PDT)
Received: from mailhost.auckland.ac.nz (larry.its.auckland.ac.nz [130.216.12.34]) by core3.amsl.com (Postfix) with ESMTP id C417A3A6A92 for <tls@ietf.org>; Mon, 6 Oct 2008 02:44:17 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1]) by mailhost.auckland.ac.nz (Postfix) with ESMTP id 6A45219FEF; Mon, 6 Oct 2008 22:44:52 +1300 (NZDT)
X-Virus-Scanned: by amavisd-new at mailhost.auckland.ac.nz
Received: from mailhost.auckland.ac.nz ([127.0.0.1]) by localhost (larry.its.auckland.ac.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6IlspVEhdQJK; Mon, 6 Oct 2008 22:44:52 +1300 (NZDT)
Received: from iris.cs.auckland.ac.nz (iris.cs.auckland.ac.nz [130.216.33.152]) by mailhost.auckland.ac.nz (Postfix) with ESMTP id 4FB2319FE2; Mon, 6 Oct 2008 22:44:52 +1300 (NZDT)
Received: from wintermute01.cs.auckland.ac.nz (wintermute01.cs.auckland.ac.nz [130.216.34.38]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by iris.cs.auckland.ac.nz (Postfix) with ESMTP id 638DE19EC0BA; Mon, 6 Oct 2008 22:44:49 +1300 (NZDT)
Received: from pgut001 by wintermute01.cs.auckland.ac.nz with local (Exim 4.63) (envelope-from <pgut001@wintermute01.cs.auckland.ac.nz>) id 1Kmme1-0007As-9b; Mon, 06 Oct 2008 22:44:49 +1300
From: pgut001@cs.auckland.ac.nz
To: simon@josefsson.org, tls@ietf.org
In-Reply-To: <87abdit8c2.fsf_-_@mocca.josefsson.org>
Message-Id: <E1Kmme1-0007As-9b@wintermute01.cs.auckland.ac.nz>
Date: Mon, 06 Oct 2008 22:44:49 +1300
Subject: Re: [TLS] Verifying X.509 Certificate Chains out of order
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tls-bounces@ietf.org
Errors-To: tls-bounces@ietf.org

Simon Josefsson <simon@josefsson.org> writes:

>It is claimed that OpenSSL, IE and Firefox does not enforce the second
>MUST in the paragraph above, and succeeds in verifying an
>out-of-sequence chain.  I haven't verified the claim.  It appears as if
>the OpenSSL developers don't consider their behaviour as a bug (see
>reply below).

Add cryptlib to the list of implementations that don't care about the order. 
In fact I'd be kinda surprised if anyone (well, apart from GnuTLS) cared about 
cert order.

>What are others opinion on this?  I'm looking for some guidance on
>whether we should modify our current behaviour.

I'd say modify it, in fact I'm not sure what the rationale for requiring 
ordering was in the original spec, "it's tidier that way" doesn't strike me as 
a good argument :-).

Peter.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email