Re: CRL verification problem

Hi!

In RFC 5280, the syntax of Extension is defined as: 
Extension  ::=  SEQUENCE  {
     extnID      OBJECT IDENTIFIER,
     critical    BOOLEAN DEFAULT FALSE,
     extnValue   OCTET STRING
                 -- contains the DER encoding of an ASN.1 value
                 -- corresponding to the extension type identified
                 -- by extnID
     }

That is, the boolean value encoded in SUN provider is the critical value. It
seems that BouncyCastle is ignoring this attribute of Extension (probably
because the value is the default value). But, doing that, the signature
verification fails cause the hash calculated does not inclued theses
booleans.

I think it is a critical problem, any CRL that contains the critical value
encoded in Extension will fail the cryptographic verification.




--
Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html