Topic: Baremetal Application - RsaUnPad error, bad formatting
Hi,
I'm having problems verifying client RSA certificates in a bare metal server on an embedded platform. I have a PC client that verifies properly the certificate, to discard possible errors we have set the client to use the same certificate as the server, and we have verified in Wireshark that sent certificates are the same in both ends, so certificate should not be the issue.
Doing some debugging I've observed that the error is generated in RsaUnPad(), in the first block.
if (pkcsBlock[0] != 0x0) { /* skip past zero */
invalid = 1;
}
This statement already sets invalid to 1.
if (padValue == RSA_BLOCK_TYPE_1) {
while (i<pkcsBlockLen && pkcsBlock[i++] == 0xFF) {/* Null body */}
}
else {
while (i<pkcsBlockLen && pkcsBlock[i++]) {/* Null body */}
}
if (!(i==pkcsBlockLen || pkcsBlock[i-1]==0)) {
WOLFSSL_MSG("RsaUnPad error, bad formatting");
return RSA_PAD_E;
}
With this I get i=2, while debugging in PC I obtained "i" around 500 (near the block size) if I recall correctly. Therefore I think that the block passed to the function is corrupted.
I've tried to trace where the error is but I'm getting lost among the calls and parameter changes.
In ProcessPeerCerts() the actual correct certificate is in the variable "input" so initially the correct certificate is read, somewhere in the middle it must be corrupted.
I'm using wolfssl 3.13.0.
log:
received record layer msg
wolfSSL Entering DoHandShakeMsg()
wolfSSL Entering DoHandShakeMsgType
processing certificate
wolfSSL Entering ProcessPeerCerts
Loading peer's cert chain
Put another cert into chain
Verifying Peer's cert
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthInfo
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeCrlDist
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAltNames
Unsupported name type, skipping
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
About to verify certificate signature
wolfSSL Entering ConfirmSignature
RsaUnPad error, bad formatting
wolfSSL Leaving ConfirmSignature, return -155
Confirm signature failed
Failed to verify Peer's cert
No callback override available, fatal
wolfSSL Leaving ProcessPeerCerts, return -155
wolfSSL Leaving DoHandShakeMsgType(), return -155
wolfSSL Leaving DoHandShakeMsg(), return -155
wolfSSL error occurred, error = -155
I'd appreciate some help, maybe this data is helpful to fix my problem. Tell me if more there is more useful information that I can add.