Re: [TLS] Verifying X.509 Certificate Chains out of order

Peter Gutmann wrote:
> 
> Martin Rex <Martin.Rex@sap.com> writes:
> 
> >Looking at the official protocol spec, the possibility to send an empty list
> >of certificate_authorities in the CertificateRequest message was introduced
> >as a purely optional feature with TLS v1.1. It was _NOT_ previously allowed
> >to send an empty list in the SSL v3 and TLS v1.0 specifications!
> 
> Yes it is.  The minimum length 3 can be used to encode a zero-length ASN.1
> SEQUENCE (using BER encoding), there's nothing there that says it has to
> contain anything.  I've been sending this in my certRequest for, oh, about 10
> years now without running into any problems.

Looking at the TLS v1.0 spec again:

       opaque DistinguishedName<1..2^16-1>;

       struct {
           ClientCertificateType certificate_types<1..2^8-1>;
           DistinguishedName certificate_authorities<3..2^16-1>;
       } CertificateRequest;

Would a zero-length ASN.1 SEQUENCE not require that DistinguishedName
have a zero length?

TLS v1.1 added support for an empty list with this change:

      opaque DistinguishedName<1..2^16-1>;

      struct {
          ClientCertificateType certificate_types<1..2^8-1>;
          DistinguishedName certificate_authorities<0..2^16-1>;
      } CertificateRequest;

which allows certificate_authorities to be empty, but still requires
DistinguishedName to be non-empty (if sent).

(I admit I've never implemented SSL/TLS, so I'm not deeply intimate
 with the actual code).

-Martin
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls