RE: Prime239v1 self-signed certificate cannot be verified
Eric Tournier <[email protected]> Mon, 16 Dec 2019 13:51:18 +0000
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
--_000_558d6eddb99d46b084f5041aa8098030SRVMAILkeynectissalocal_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I tried to sign some text data after issuing a ECDSA prime239v1 certifica=
te. The verification fails, here is the following code:
Signature ecdsaVerify =3D Signature.getInstance("SHA256withECDSA", =
BouncyCastleProvider.PROVIDER_NAME);
ecdsaVerify.initVerify(certificate.getPublicKey());
ecdsaVerify.update(plaintext.getBytes("UTF-8"));
boolean isValidSignature =3D ecdsaVerify.verify(Base64.decode(signa=
tureAsString));
The verification of my self-signed certificate with its own private key f=
ails in this part of BC code (org.bouncycastle.crypto.signers.ECDSASigner):
ECCurve curve =3D point.getCurve();
if (curve !=3D null)
{
BigInteger cofactor =3D curve.getCofactor();
if (cofactor !=3D null && cofactor.compareTo(EIGHT) <=3D 0)
{
ECFieldElement D =3D getDenominator(curve.getCoordinateSyst=
em(), point);
if (D !=3D null && !D.isZero())
{
ECFieldElement X =3D point.getXCoord();
while (curve.isValidFieldElement(r))
{
ECFieldElement R =3D curve.fromBigInteger(r).multip=
ly(D);
if (R.equals(X))
{
return true;
}
r =3D r.add(n);
}
return false;
}
}
}
The debug shows that in the inner while, we cannot find any ECFieldEleeme=
nt R which is equal to X. As I haven't any idea of what it means (I have to=
work on mathematical basis of ECDSA) :D I need some help :)
The offending certificate is (Base64 format):
-----BEGIN CERTIFICATE-----
MIIBljCCAUGgAwIBAgISESE/0HMzJQ81M17SAVeO0cQmMAoGCCqGSM49BAMCMB0x
GzAZBgNVBAMMEkhTU1Rlc3RUb0JlUmVtb3ZlZDAgFw0xOTA5MDEwMDAwMDFaGA8y
MDU0MDkwMTAwMDAwMVowHTEbMBkGA1UEAwwSSFNTVGVzdFRvQmVSZW1vdmVkMFUw
EwYHKoZIzj0CAQYIKoZIzj0DAQQDPgAEFXHeoI+jd/GHUbdGk/K9BsNkpAMce9AF
DOzYcsoFYFnUyH5O7apm3jGu89b67m1htmzLC4I3AJPsSgUqo2MwYTAPBgNVHRMB
Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBNjAdBgNVHQ4EFgQURoQKwgEzI0rLbwHh
aykbLkF280QwHwYDVR0jBBgwFoAURoQKwgEzI0rLbwHhaykbLkF280QwCgYIKoZI
zj0EAwIDQwAwQAIefcAQYSSqCtoE1waIgQijyZZOC7b3DFub8KP/i4lYAh5ckkpU
cJgDR4UOjk/oa9PSc3I51q/Pv2T9PLoZdeI=3D
-----END CERTIFICATE-----
Last, obviously, when the keypair is generated in a soft way, by BC, ever=
ything works fine.
Thanks in advance for your ideas and answers
=C9ric
De : Eric Tournier [mailto:[email protected]]
Envoy=E9 : vendredi 13 d=E9cembre 2019 09:47
=C0 : 'dgh-rTAZ0PM/[email protected]' <dgh-rTAZ0PM/[email protected]>; dev-crypto@bouncyc=
astle.org
Objet : RE: [dev-crypto] Prime239v1 self-signed certificate cannot be verif=
ied
Hi everybody
Thanks for the answer, David
In fact OpenSSL is the only one which seems to verify the certificate wit=
hout throwing an error, with the following:
#openssl verify -CAfile prime239v1.cer prime239v1.cer
As I'm not an OpenSSL guru, I don't know if it is lying or not. In fact b=
oth BC and SUN say that they cannot verify my self-signed certificate with =
its own public key
I'll try to sign something with the private key (which is in our HSM) and=
then verifying it. Then I go back here with the results
=C9ric
De : David Hook [mailto:dgh-rTAZ0PM/[email protected]]
Envoy=E9 : jeudi 12 d=E9cembre 2019 01:56
=C0 : [email protected]<mailto:[email protected]>
Objet : Re: [dev-crypto] Prime239v1 self-signed certificate cannot be verif=
ied
It looks alright to me as well. How are you verifying it in openSSL though?=
I've played around with the openssl verify command and it seems I can get =
it to print OK in a number of situations where I would not have expected it=
. Something clearly is not right here. Have you tried using java to sign a =
short message and then verify it? That would at least tell us if it's the s=
ignature or the certificate encoding that is the issue.
Regards,
David
--_000_558d6eddb99d46b084f5041aa8098030SRVMAILkeynectissalocal_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:"Calibri",sans-serif;
mso-fareast-language:FR;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=3D"white" lang=3D"FR" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Hi,<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
I tried to sign some text data after issuing a ECDSA prime239v1 certificate=
. The verification fails, here is the following code:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; Signature ecdsaVerify =3D Signature.getInstance("SHA256w=
ithECDSA", BouncyCastleProvider.PROVIDER_NAME);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; ecdsaVerify.initVerify(certificate.getPublicKey());<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; ecdsaVerify.update(plaintext.getBytes("UTF-8"));<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; boolean isValidSignature =3D ecdsaVerify.verify(Base64.decode=
(signatureAsString));<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
The verification of my self-signed certificate with its own private key fai=
ls in this part of BC code (org.bouncycastle.crypto.signers.ECDSASigner):<o=
:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; ECCurve curve =3D point.getCurve();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; if (curve !=3D null)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; BigInteger cofactor =3D curve.getCofa=
ctor();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; if (cofactor !=3D null && cof=
actor.compareTo(EIGHT) <=3D 0)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; ECFieldElemen=
t D =3D getDenominator(curve.getCoordinateSystem(), point);<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; if (D !=3D nu=
ll && !D.isZero())<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; {<o:p></o:p><=
/span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; ECFieldElement X =3D point.getXCoord();<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; while (curve.isValidFieldElement(r))<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; ECFieldElement R =3D curve.fromBigIntege=
r(r).multiply(D);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; if (R.equals(X))<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; {<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; return true;<o:p=
></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; }<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; r =3D r.add(n);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; }<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; &n=
bsp; return false;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; }<o:p></o:p><=
/span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; }<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">  =
; }<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
The debug shows that in the inner while, we cannot find any
</span><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Cou=
rier New";color:#1F497D">ECFieldEleement</span><span lang=3D"EN-US" st=
yle=3D"color:#1F497D">
</span><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Cou=
rier New";color:#1F497D">R
</span><span lang=3D"EN-US" style=3D"color:#1F497D">which is equal to </spa=
n><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Courier =
New";color:#1F497D">X.
</span><span lang=3D"EN-US" style=3D"font-size:12.0pt;color:#1F497D">As I h=
aven’t any idea of what it means (I have to work on mathematical basi=
s of ECDSA) :D I need some help :)<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"> The offending certificate is (Base64 format):<o:p></o:p></=
span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">-----BEGIN CERTIFICATE-----<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">MIIBljCCAUGgAwIBAgISESE/0HMzJQ81M17SAVeO0cQmMA=
oGCCqGSM49BAMCMB0x<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">GzAZBgNVBAMMEkhTU1Rlc3RUb0JlUmVtb3ZlZDAgFw0xOT=
A5MDEwMDAwMDFaGA8y<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">MDU0MDkwMTAwMDAwMVowHTEbMBkGA1UEAwwSSFNTVGVzdF=
RvQmVSZW1vdmVkMFUw<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">EwYHKoZIzj0CAQYIKoZIzj0DAQQDPgAEFXHeoI+jd/=
GHUbdGk/K9BsNkpAMce9AF<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">DOzYcsoFYFnUyH5O7apm3jGu89b67m1htmzLC4I3AJPsSg=
Uqo2MwYTAPBgNVHRMB<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBNjAdBgNVHQ4EFg=
QURoQKwgEzI0rLbwHh<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">aykbLkF280QwHwYDVR0jBBgwFoAURoQKwgEzI0rLbwHhay=
kbLkF280QwCgYIKoZI<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">zj0EAwIDQwAwQAIefcAQYSSqCtoE1waIgQijyZZOC7b3DF=
ub8KP/i4lYAh5ckkpU<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">cJgDR4UOjk/oa9PSc3I51q/Pv2T9PLoZdeI=3D<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cour=
ier New";color:#1F497D">-----END CERTIFICATE-----</span><span lang=3D"=
EN-US" style=3D"font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"> Last, obviously, when the keypair is generated in a soft w=
ay, by BC, everything works fine.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D">Thanks in advance for your ideas and answers<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D">=C9ric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:12.0pt;color=
:#1F497D"><o:p> </o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"color:windowtext;mso-fareast-langu=
age:FR">De :</span></b><span style=3D"color:windowtext;mso-fareast-lan=
guage:FR"> Eric Tournier [mailto:[email protected]]
<br>
<b>Envoy=E9 :</b> vendredi 13 d=E9cembre 2019 09:47<br>
<b>=C0 :</b> 'dgh-rTAZ0PM/[email protected]' <dgh-rTAZ0PM/[email protected]>; =
[email protected]<br>
<b>Objet :</b> RE: [dev-crypto] Prime239v1 self-signed certificate can=
not be verified<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D">Hi everybody<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"color:#1F497D"> Thanks for the =
answer, David<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
In fact OpenSSL is the only one which seems to verify the certificate witho=
ut throwing an error, with the following:
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-=
family:"Courier New";color:#1F497D">#openssl verify -CAfile prime=
239v1.cer prime239v1.cer</span><span lang=3D"EN-US" style=3D"font-family:&q=
uot;Courier New";color:#1F497D"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
As I’m not an OpenSSL guru, I don’t know if it is lying or not.=
In fact both BC and SUN say that they cannot verify my self-signed certifi=
cate with its own public key<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> =
I’ll try to sign something with the private key (which is in our HSM)=
and then verifying it. Then I go back here with the results<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">=C9ric<=
o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"color:windowtext;mso-fareast-langu=
age:FR">De :</span></b><span style=3D"color:windowtext;mso-fareast-lan=
guage:FR"> David Hook [<a href=3D"mailto:dgh-rTAZ0PM/[email protected]">mailto:dgh=
@cryptoworkshop.com</a>]
<br>
<b>Envoy=E9 :</b> jeudi 12 d=E9cembre 2019 01:56<br>
<b>=C0 :</b> <a href=3D"mailto:[email protected]">dev-crypto=
@bouncycastle.org</a><br>
<b>Objet :</b> Re: [dev-crypto] Prime239v1 self-signed certificate can=
not be verified<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;mso-fareast-language=
:FR"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal">It looks alright to me as well. How are you verifyin=
g it in openSSL though? I've played around with the openssl verify command =
and it seems I can get it to print OK in a number of situations where I wou=
ld not have expected it. Something
clearly is not right here. Have you tried using java to sign a short messa=
ge and then verify it? That would at least tell us if it's the signature or=
the certificate encoding that is the issue.<o:p></o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class=3D"MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class=3D"MsoNormal">David<o:p></o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
<p><o:p> </o:p></p>
</div>
</body>
</html>
--_000_558d6eddb99d46b084f5041aa8098030SRVMAILkeynectissalocal_--