Re: possible Bug in OpenSSL - rfc 3161 - TSA service

[kapetr]

SORRY - now with attachment :-)

Dne 15.3.2013 22:34, Peter Sylvester napsal(a):

for those who don't read openssl-dev

Thanks - I did not know that it is discussed there too.


=>
If you have the updated version, could you please run and test:



Verification: FAILED


All needed files are in attachment.


FYI: it is real (no testTSA) version without "-cert".

--------------------------

The version with included cert in TSR fails already by parsing.
Does it change in patched version ?
(BTW - manual parsing with asn1parse works)



Verification: FAILED



Thanks --kapetr

I have no experiences with patching, compiling, .. so I have to wait for package in repo or PPA. openssl ts -verify -queryfile file.txt-nononce-sha256-nocert.tsq -in file.txt-nononce-sha256-nocert.postsignum.tsr -CAfile postsignum_qca2_root.pem -untrusted postsignum_qca2_sub+tsa_tsu2-newer.pem 139898903938720:error:2F067065:time stamp routines:TS_CHECK_SIGNING_CERTS:ess signing certificate error:ts_rsp_verify.c:291: The signing cert is the first one ESSCertId in certs in TSR, so it should pass now. Does it ? openssl ts -verify -queryfile file.txt-nonce-sha256-cert.tsq -in file.txt-nonce-sha256-cert.postsignum.tsr -CAfile postsig/postsignum_qca2_root.pem -untrusted postsig/postsignum_qca2_sub+tsa_tsu2-newer.pem 139961289148064:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1319: 139961289148064:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=X509 139961289148064:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:711:Field=cert, Type=PKCS7_SIGNED 139961289148064:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:751: 139961289148064:error:0D08403A:asn1 encoding routines:ASN1_TEMPLATE_EX_D2I:nested asn1 error:tasn_dec.c:579:Field=d.sign, Type=PKCS7 139961289148064:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:751:Field=token, Type=TS_RESP

-------- Original Message --------
Subject:        [openssl.org #3016] openssl ts fix
Date:   Wed, 13 Mar 2013 16:13:31 +0100
From:   Peter Sylvester via RT <r...@openssl.org>
Reply-To:       openssl-...@openssl.org
CC:     openssl-...@openssl.org



Hi,

I have "weakend" the Esscertid logic a bit. Only the signer certficate is
checked and it must be in the first Esscertid.

This resolves issues when TSAs add attribute certs etc.
Since RFC 3161 does not require a client to check anything
else than the presence of the signer cert (and even is is badly written),
I think the verification of a "chain" in the ess was not appropriate
logic.

regards

postsignum.tar
Description: Unix tar archive