Subject: Re: [dane] Hash specs, and examples in sec. 2.3

From: Simon Arlott <[email-masked]>
Date: Mon, 19 Mar 2012 21:27:43 +0000

On 25/02/12 11:37, Ilari Liusvaara wrote:
> On Sat, Feb 25, 2012 at 10:38:23AM +0100, Pieter Lexis wrote:
> 
> Did some verification on these.
> 
>> These record were created using swede, so don't use it to verify the
>> correctness of them :).
> 
> Well, I used some custom tool (hex to binary converter), sha256sum,
> sha512sum and dumpasn1.

I've checked the example in draft 18 using python unhexlify, and the
certificate looks ok to me.

I get the same SHA256/512 hashes (after removing the extra \n from my
decoded output, which openssl doesn't complain about).

$ sha256sum cert.der
efddf0d915c7bdc5782c0881e1b2a95ad099fbdd06d7b1f77982d9364338d955  cert.der

I also get the same subject public key info:
$ openssl x509 -pubkey -inform DER -in cert.der | openssl rsa -pubin | \
	head -n -1 | tail -n +2 | base64 -d > subj2.der
writing RSA key
$ sha256sum subj.der subj2.der 
8755cdaa8fe24ef16cc0f2c918063185e433faaf1415664911d9e30a924138c4  subj.der
8755cdaa8fe24ef16cc0f2c918063185e433faaf1415664911d9e30a924138c4  subj2.der

The content is the same as the SubjectPublicKeyInfo in the certificate:
$ openssl asn1parse -inform DER -in cert.der -i
  286:d=2  hl=4 l= 418 cons:   SEQUENCE          
  290:d=3  hl=2 l=  13 cons:    SEQUENCE          
  292:d=4  hl=2 l=   9 prim:     OBJECT            :rsaEncryption
  303:d=4  hl=2 l=   0 prim:     NULL              
  305:d=3  hl=4 l= 399 prim:    BIT STRING        

$ openssl asn1parse -inform DER -in subj.der -i
    0:d=0  hl=4 l= 418 cons: SEQUENCE          
    4:d=1  hl=2 l=  13 cons:  SEQUENCE          
    6:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   17:d=2  hl=2 l=   0 prim:   NULL              
   19:d=1  hl=4 l= 399 prim:  BIT STRING

and it matches the RFC3280 definition:
   SubjectPublicKeyInfo  ::=  SEQUENCE  {
        algorithm            AlgorithmIdentifier,
        subjectPublicKey     BIT STRING  }
   AlgorithmIdentifier  ::=  SEQUENCE  {
        algorithm               OBJECT IDENTIFIER,
        parameters              ANY DEFINED BY algorithm OPTIONAL  }

However, the "parameters" value is optional. I can remove the NULL and
the "openssl rsa" command still parses it ok. RFC3280 6.1.4 appears to
allow this:
      If the subjectPublicKeyInfo field of the certificate contains an
      algorithm field with null parameters or parameters are omitted,
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Would it be necessary to make it clear that the SubjectPublicKeyInfo
raw data must be the ASN.1 SEQUENCE extracted from the certificate, and
not a reconstructed equivalent form?

$ openssl asn1parse -inform DER -in subj3.der -i
    0:d=0  hl=4 l= 416 cons: SEQUENCE          
    4:d=1  hl=2 l=  11 cons:  SEQUENCE          
    6:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   17:d=1  hl=4 l= 399 prim:  BIT STRING

-- 
Simon Arlott

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 19 Mar 2012 17:36:42 -0700

> not a reconstructed equivalent form?

That's a false dichotomy. You cannot reconstruct an "equivalent form" for anything that has optional parameters.

--Paul Hoffman