1 Topic by huba (edited by huba 2017-07-19 00:14:54)

  • huba
  • Member
  • Offline
  • Registered: 2017-07-12
  • Posts: 4

Topic: Certificate decode error during TLS handshake

The main problem is when decoding a certificate during TLS handshake.

Received certificate:
https://lapo.it/asn1js/#308203C93082036 … A9D5721F92

you can see parameter called keyUsage, but when it's decoded by wolfCrypt in function CheckBitString is a premise that the lowest bit of value have to be 1. I don't know why. The certificate is ok but wolfCrypt can't parse it.

input = 03 02 05 80

static int CheckBitString(const byte* input, word32* inOutIdx, int* len,
                          word32 maxIdx, int zeroBits, byte* unusedBits)
{
    ...

    if (b >= 0x08)
        return ASN_PARSE_E;
    if (b != 0) {                                             // b = 5
        if ((byte)(input[idx + length - 1] << (8 - b)) != 0)
            return ASN_PARSE_E;
        if (((input[idx + length - 1] >> b) & 0x01) != 0x01)  /// PROBLEM!!!!!! input[idx + length - 1] = 0x80, (0x80 >> 5 & 1) == 0!!
            return ASN_PARSE_E;
    }

    ...
    return 0;
}

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: Certificate decode error during TLS handshake

Hi huba,

There is nothing wrong with that certificate and with a default configuration wolfSSL can parse it just fine.

Please see the attached cert to be included in the test program and I am including the test app inline here:

#include <stdio.h>
#include <wolfssl/options.h>

#include <stdlib.h>
#include <unistd.h>
#include <wolfssl/wolfcrypt/types.h>
#include <wolfssl/ssl.h>
#include "kaleb-cert.h"

int main(int argc, char** argv)
{
    int ret;
    int fail = 0;
    WOLFSSL* ssl;
    WOLFSSL_CTX* ctx;

    wolfSSL_Init();
    wolfSSL_Debugging_ON();

    ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method());
    if (ctx == NULL) {
        printf("CTX creation failed\n");
        return -1;
    }

    if ((ret = wolfSSL_CTX_use_certificate_buffer(ctx, myCert,
                        sizeof(myCert), SSL_FILETYPE_ASN1)) != SSL_SUCCESS) {
        printf("load_certificate_buffer returned err: %d\n", ret);
        fail = 1;
    }

    if (fail != 1)
        printf("Successfully loaded certificate\n");

    wolfSSL_CTX_free(ctx);

    return 0;

}

Could you tell me the settings you are using to build wolfSSL perhaps there is a misconfiguration for the algorithms necessary to parse the cert.


Warm Regards,

Kaleb

DEBUG LOG from test program:

wolfSSL Entering WOLFSSL_CTX_new_ex
wolfSSL Entering wolfSSL_CertManagerNew
wolfSSL Leaving WOLFSSL_CTX_new, return 0
wolfSSL Entering wolfSSL_CTX_use_certificate_buffer
Checking cert signature type
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
Got Key
ECDSA cert signature
Successfully loaded certificate
wolfSSL Entering SSL_CTX_free
CTX ref count down to 0, doing full free
wolfSSL Entering wolfSSL_CertManagerFree
wolfSSL Leaving SSL_CTX_free, return 0
Post's attachments

kaleb-cert.h 5.98 kb, 2 downloads since 2017-08-02 

You don't have the permssions to download the attachments of this post.

Kaleb J. Himes's Website

Share