Martin Szotkowski wrote:
>
>
>
> >
> > SET OF should be sorted but the request is not sorted, or not sorted
> > correctly.
>
> where is defined order?
>
Each SET OF component should be in lexical order, it is in the DER
encoding rules. If you check the SET OF stuff using dumpasn1 you get:
335 31 134: SET {
338 30 12: SEQUENCE {
340 06 3: OBJECT IDENTIFIER keyUsage (2 5 29 15)
345 04 5: OCTET STRING
: 03 03 00 60 00
: }
352 30 64: SEQUENCE {
354 06 3: OBJECT IDENTIFIER certificatePolicies (2 5 29
32)
359 04 57: OCTET STRING
: 30 37 30 0B 06 09 2B 06 01 04 01 9F 36 01 00
30
: 0C 06 0A 2B 06 01 04 01 9F 36 01 01 01 30 0C
06
: 0A 2B 06 01 04 01 9F 36 01 02 00 30 0C 06 0A
2B
: 06 01 04 01 9F 36 01 03 01
: }
418 30 25: SEQUENCE {
420 06 3: OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29
14)
425 04 18: OCTET STRING
: 04 10 C7 23 CF 04 00 53 C6 9A D1 47 E4 CE ED
F9
: 99 EE
: }
445 30 25: SEQUENCE {
447 06 3: OBJECT IDENTIFIER subjectAltName (2 5 29 17)
452 04 18: OCTET STRING
: 30 10 81 0E 68 73 62 75 6E 69 78 40 70 76 74
2E
: 63 7A
: }
: }
: }
: }
: }
Note the first two bytes of each SEQUENCE:
30 12
30 64
30 25
30 25
which isn't ordered correctly.
> > I suppose it is possible to make OpenSSL to retain the original encoding
> > and work out signatures from that.
>
> I thought that signature are compute from original source and than is decode
> content.
>
Well if it follows the DER encoding rules it shouldn't matter. However
there's so much broken stuff out there (including older versions of
OpenSSL) that this can cause problems, as this example shows.
Anyway I've updated the development version to store the original
encoding and work out signatures from that. It will now verify your
request correctly. It will be in the next snapshot and OpenSSL 0.9.6
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
