Re: scd: ambiguous certificate IDs for pkcs#15 certificates

Werner Koch via Gnupg-devel <[email protected]> Mon, 19 Feb 2024 16:53:04 +0100

Newsgroups	gmane.comp.encryption.gpg.devel
Message-ID	<[email protected]>

On Mon, 19 Feb 2024 16:33, Mario Haustein said:

> your solution sounds much more simpler than mine and should solve the problem 
> with record files as well. Maybe it's a good idea to separate the counter from 
> the ID by an additional '.', isn't it?

Much more work and code unfortunately.
> At least it shifts the problem from getting the root certificate to just 
> verifying the fingerprint of the root certificate. The latter approach is more 
> robust for end-users IMHO.

Right.

> It seems the counter is application-global, but collision detection is just 
> scoped to the object directory.

Good attach.  Please add the attached patch.


Shalom-Salam,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

0001-scd-p15-Check-all-cert-stores-for-dups.patch (text/x-diff, 1.3 KB)

From 412d3e3f4d16a08f5d1fac54757d8f0c8dec1833 Mon Sep 17 00:00:00 2001
From: Werner Koch <[email protected]>
Date: Mon, 19 Feb 2024 16:50:22 +0100
Subject: [PATCH GnuPG] scd:p15: Check all cert stores for dups.

--
---
 scd/app-p15.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scd/app-p15.c b/scd/app-p15.c
index 9ed51ae04..8a869279d 100644
--- a/scd/app-p15.c
+++ b/scd/app-p15.c
@@ -2611,7 +2611,14 @@ read_ef_cdf (app_t app, unsigned short fid, int cdftype, cdf_object_t *result)
       /* Card's have been found in the wild which do not have unique
        * IDs for their certificate objects.  If we detect this we
        * append a counter to the ID.  */
-      objidextralen = !!objid_in_cdflist_p (cdflist, objid, objidlen);
+      objidextralen =
+        (objid_in_cdflist_p (cdflist, objid, objidlen)
+         || objid_in_cdflist_p (app->app_local->certificate_info,
+                                objid, objidlen)
+         || objid_in_cdflist_p (app->app_local->trusted_certificate_info,
+                                objid, objidlen)
+         || objid_in_cdflist_p (app->app_local->useful_certificate_info,
+                                objid, objidlen));
       cdf->objidlen = objidlen + objidextralen;
       cdf->objid = xtrymalloc (objidlen + objidextralen);
       if (!cdf->objid)
-- 
2.39.2

openpgp-digital-signature.asc (application/pgp-signature, 247 B)