IETF Logo Mail Archive

Re: [TLS] Verifying X.509 Certificate Chains out of order

Peter Sylvester <Peter.Sylvester@edelweb.fr> Tue, 07 October 2008 14:43 UTC

Return-Path: <tls-bounces@ietf.org>
X-Original-To: tls-archive@ietf.org
Delivered-To: ietfarch-tls-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0860928C161; Tue, 7 Oct 2008 07:43:33 -0700 (PDT)
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CB6628C161 for <tls@core3.amsl.com>; Tue, 7 Oct 2008 07:43:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.238
X-Spam-Level:
X-Spam-Status: No, score=0.238 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_BAD_ID=2.837]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j21NUZUXR4xw for <tls@core3.amsl.com>; Tue, 7 Oct 2008 07:43:26 -0700 (PDT)
Received: from ganymede.on-x.com (ganymede.on-x.com [194.51.68.3]) by core3.amsl.com (Postfix) with ESMTP id 6431E3A6AD7 for <tls@ietf.org>; Tue, 7 Oct 2008 07:43:26 -0700 (PDT)
Received: from vinea.on-x.com (sedna.puteaux.on-x [192.168.10.9]) by ganymede.on-x.com (Postfix) with ESMTP id E2EE213; Tue, 7 Oct 2008 16:44:03 +0200 (CEST)
Received: from [193.51.14.5] ([212.234.46.65]) by vinea.on-x.com (Lotus Domino Release 5.0.11) with ESMTP id 2008100716440196:159430 ; Tue, 7 Oct 2008 16:44:01 +0200
Message-ID: <48EB745B.9050403@edelweb.fr>
Date: Tue, 07 Oct 2008 16:38:19 +0200
From: Peter Sylvester <Peter.Sylvester@edelweb.fr>
User-Agent: Thunderbird 1.5.0.9 (X11/20061206)
MIME-Version: 1.0
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
References: <E1KnDKN-0005hN-Q8@wintermute01.cs.auckland.ac.nz>
In-Reply-To: <E1KnDKN-0005hN-Q8@wintermute01.cs.auckland.ac.nz>
X-MIMETrack: Itemize by SMTP Server on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 10/07/2008 04:44:02 PM, Serialize by Router on vinea/ON-X(Release 5.0.11 |July 24, 2002) at 10/07/2008 04:44:03 PM, Serialize complete at 10/07/2008 04:44:03 PM
Cc: tls@ietf.org
Subject: Re: [TLS] Verifying X.509 Certificate Chains out of order
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============2109131215=="
Sender: tls-bounces@ietf.org
Errors-To: tls-bounces@ietf.org

I am not sure that the following structure is properly defined:


Structure of this message:

      opaque ASN.1Cert<1..2^24-1>;

      struct {
          ASN.1Cert certificate_list<0..2^24-1>;
      } Certificate;

   certificate_list
      This is a sequence (chain) of certificates. 

A little bit later: 

Also, PKCS #7 defines a SET rather than a SEQUENCE, making the task
   of parsing the list more difficult. 

Still, there is no thing that indicates D|B|XER encoding of
something like  SEQUENCE OF Certificate" 




_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email