[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 22 Apr 2014 13:22:58 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Ludwig Nussel <ludwig.nussel@...e.de>
CC: oss-security@...ts.openwall.com
Subject: Re: X.509 name constraints and potential interpretation
conflict
On 08/20/2013 06:40 PM, Ludwig Nussel wrote:
> Florian Weimer wrote:
>> NSS CA roots are widely reused, but the implementation deviates from
>> RFC 5280 in such a way that NSS can safely accept additional root
>> certificates as long as they have name constraints. I think this is a
>> bug in RFC 5280, and the fix in NSS is sound, but it could still
>> result in surprising behavior if the root store is used unfiltered
>> with TLS implementations that lack this bug fix.
>>
>> For reference, here is the RFC 5280 errata I submitted:
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Florian Weimer <fweimer@...hat.com>
>>
>> Section: 4.2.1.10
>>
>> Original Text
>> -------------
>> DNS name restrictions are expressed as host.example.com. Any DNS
>> name that can be constructed by simply adding zero or more labels to
>> the left-hand side of the name satisfies the name constraint. For
>> example, www.host.example.com would satisfy the constraint but
>> host1.example.com would not.
>>
>>
>> Corrected Text
>> --------------
>> [Add this to the paragraph]
>>
>> If an implementation extracts DNS names from the subject
>> distinguished name, DNS name restrictions MUST be applied
>> to these names as well.
>
> Do you have an idea in mind how to do that in practice? E.g with
> openssl?
OpenSSL does not really care about host names, so you have to look at
the chain more or less manually. I suspect it's okay to look at subject
alternative names of the end entity certificate exclusively if one
certificate in the chain has a name constraint. The PKIX validation
code in OpenSSL should enforce the name constraints, and ignoring the
subject distinguished name should be sufficient to give these checks teeth.
It is, however, against the RFC. The PKIX WG says that we should just
assume that CAs issue compliant certificates, which completely misses
the point of name constraints (at least what they mean to me, I expected
them to contain the impact of non-compliant CAs).
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
