Re: Certificates with DN UniqueIdentifier

--- On Sun, 2/14/10, Peter Gutmann <[email protected]> wrote:

> From: Peter Gutmann <[email protected]>
> Subject: Re: [Cryptlib] Certificates with DN UniqueIdentifier
> To: [email protected], [email protected]
> Date: Sunday, February 14, 2010, 9:33 PM
> Mario Crypto <[email protected]>
> writes:
>
> >This works fine with almost any certificate, but when I
> use a certificate
> >with the DN UniqueIdentifier in the "Subject" and/or
> the "Issuer" this
> >function fails. Indeed when debuging my code, I realize
> that it breaks in the
> >function "readAVA" part of the file "cert/dn_rw.c",
> lines 79-81:
>
> Since the UniqueIdentifier usually (meaning in pretty much
> every case I've
> encountered so far) contains an encapsulated ASN.1 object,
> cryptlib tries to
> burrow inside it to extract the inner object.  In this
> case there's no inner
> object, so cryptlib thinks there's an error.  To fix
> this, just comment out
> the 'if( tag == BER_BITSTRING )' code block.
>
> >I use this kind of certificates in several services
> with no problem.
>
> Probably because other implementations just ignore the
> field, e.g. I've just
> checked the Windows cert browser and it doesn't even
> process it.
>
> Peter.
>

Hi all,

You are right Peter, because UId is codified as bitstring. Indeed Win cert browser only shows the hexadecimal representation of this bit array. 

As you said, the 'if( tag == BER_BITSTRING )' code block is trying to go deeper looking for another object. What if the nested object does not exist?   do other functions have the same behavior?


M.



      


_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.