Re: Re: Re: Re: why publickey sequence use DLSequence in CMP cr-CertTemplate entity ?

Hi Team, Matti,

Thanks for Matti reproduce it.
When I test msgBuilder.setSerialNumber(BigInteger.ONE);  It was encode to a OctetString, not a Integer.

(just add setSerialNumber()  to Matti 's code)

Thanks,
Gsealy
------------------------------------------------
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PublicKey;
import java.security.Security;
import java.security.spec.ECGenParameterSpec;

import org.bouncycastle.asn1.ASN1Integer;
import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.crmf.CertTemplate;
import org.bouncycastle.asn1.crmf.CertTemplateBuilder;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.cert.crmf.CertificateRequestMessage;
import org.bouncycastle.cert.crmf.CertificateRequestMessageBuilder;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.util.encoders.Hex;

public class TestBCCertTemplate {

    public static void main(String[]args) {
        try {
            Security.addProvider(new BouncyCastleProvider());

            final ECGenParameterSpec ecGenSpec = new ECGenParameterSpec("sm2p256v1");
            final KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC","BC");
            kpg.initialize(ecGenSpec);
            final KeyPair kp = kpg.generateKeyPair();
            final PublicKey pubKey = kp.getPublic();
            final byte[] pubKeyDer = pubKey.getEncoded();
            final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(pubKeyDer);
            final byte[] spkiDer = keyInfo.getEncoded();

            System.out.println("pubkey = "+ Hex.toHexString(pubKeyDer));
            System.out.println("spki = "+Hex.toHexString(spkiDer));

            final CertificateRequestMessageBuilder msgBuilder = new CertificateRequestMessageBuilder(
                    BigInteger.ONE);
            msgBuilder.setSerialNumber(BigInteger.ONE);
            msgBuilder.setPublicKey(keyInfo);

            CertificateRequestMessage crm = msgBuilder.build();
            System.out.println("CRM = "+Hex.toHexString(crm.getEncoded()));

            final DERTaggedObject snDto = new DERTaggedObject(false, 1, new ASN1Integer(BigInteger.ONE));
            System.out.println("SN DTO = "+Hex.toHexString(snDto.getEncoded()));

            final DERTaggedObject keyInfoDto = new DERTaggedObject(false, 6, keyInfo);
            System.out.println("PUB KEY DTO = "+Hex.toHexString(keyInfoDto.getEncoded()));

            final CertTemplateBuilder ctb = new CertTemplateBuilder();
            ctb.setSerialNumber(new ASN1Integer(BigInteger.ONE));
            ctb.setPublicKey(keyInfo);
            final CertTemplate ct = ctb.build();
            System.out.println("CT = "+Hex.toHexString(ct.getEncoded()));

        }
        catch (Throwable e) {
            e.printStackTrace();
        }
    }
}

From: Matti Aarnio<mailto:[email protected]>
Date: 2019-05-24 01:43
To: [email protected]<mailto:[email protected]>; dev-crypto<mailto:[email protected]>
Subject: Re: [dev-crypto] Re: Re: why publickey sequence use DLSequence in CMP cr-CertTemplate entity ?
Hi David,

The code below shows this bad request generation formatting.
The same badness happens for RSA key too.
( KeyPairgenerator.getInstance("RSA","BC"); kpg.initialize(1024); )

Therefore the problem is probably in the CertTemplateBuilder.build() method.
Or more precisely the addOptional() method inside it:
    DERTaggedObject dto = new DERTaggedObject(false, 6, keyInfo);

Why does that encode the tagged thing incorrectly?

BR, Matti Aarnio


import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PublicKey;
import java.security.Security;
import java.security.spec.ECGenParameterSpec;

import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.crmf.CertTemplate;
import org.bouncycastle.asn1.crmf.CertTemplateBuilder;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.cert.crmf.CertificateRequestMessage;
import org.bouncycastle.cert.crmf.CertificateRequestMessageBuilder;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.util.encoders.Hex;

public class TestSM2Keygen {

    public static void main(String[]args) {
        try {
            Security.addProvider(new BouncyCastleProvider());

            final ECGenParameterSpec ecGenSpec = new ECGenParameterSpec("sm2p256v1");
            final KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC","BC");
            kpg.initialize(ecGenSpec);
            final KeyPair kp = kpg.generateKeyPair();
            final PublicKey pubKey = kp.getPublic();
            final byte[] pubKeyDer = pubKey.getEncoded();
            final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(pubKeyDer);
            final byte[] spkiDer = keyInfo.getEncoded();

            System.out.println("pubkey = "+Hex.toHexString(pubKeyDer));
            System.out.println("spki = "+Hex.toHexString(spkiDer));

            final CertificateRequestMessageBuilder msgBuilder = new CertificateRequestMessageBuilder(BigInteger.ONE);
            msgBuilder.setPublicKey(keyInfo);

            CertificateRequestMessage crm = msgBuilder.build();
            System.out.println("CRM = "+Hex.toHexString(crm.getEncoded()));

            final DERTaggedObject dto = new DERTaggedObject(false, 6, keyInfo);
            System.out.println("DTO = "+Hex.toHexString(dto.getEncoded()));

            final CertTemplateBuilder ctb = new CertTemplateBuilder();
            ctb.setPublicKey(keyInfo);
            final CertTemplate ct = ctb.build();
            System.out.println("CT = "+Hex.toHexString(ct.getEncoded()));

        }
        catch (Throwable e) {
            e.printStackTrace();
        }
    }
}