openssl/openssl

OpenSSL accepts PKCS#8 elliptic curve private key with inconsistent OIDs

Open

#26.471 aberto em 19 de jan. de 2025

Ver no GitHub
 (2 comments) (0 reactions) (0 assignees)C (11.262 forks)batch import
help wantedtriaged: feature

Métricas do repositório

Stars
 (30.157 stars)
Métricas de merge de PR
 (Nenhuma PRs mesclada em 30d)

Description

~ ❯❯❯ pbpaste 
-----BEGIN PRIVATE KEY-----
MIGQAgEAMBAGByqGSM49AgEGBSuBBAAiBHkwdwIBAQQgYirTZSx+5O8Y6tlGcka6
W6btJiocdrdolfcukSoTEk+gCgYIKoZIzj0DAQehRANCAAQkvPNu7Pa1GcsWU4v7
ptNfqCJVq8Cxzo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDi
Fqz3
-----END PRIVATE KEY-----
~ ❯❯❯ pbpaste | openssl pkcs8 -nocrypt
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYirTZSx+5O8Y6tlG
cka6W6btJiocdrdolfcukSoTEk+hRANCAAQkvPNu7Pa1GcsWU4v7ptNfqCJVq8Cx
zo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDiFqz3
-----END PRIVATE KEY-----
~ ❯❯❯ pbpaste | der2ascii -pem
SEQUENCE {
  INTEGER { 0 }
  SEQUENCE {
    # ecPublicKey
    OBJECT_IDENTIFIER { 1.2.840.10045.2.1 }
    # secp384r1
    OBJECT_IDENTIFIER { 1.3.132.0.34 }
  }
  OCTET_STRING {
    SEQUENCE {
      INTEGER { 1 }
      OCTET_STRING { `622ad3652c7ee4ef18ead9467246ba5ba6ed262a1c76b76895f72e912a13124f` }
      [0] {
        # secp256r1
        OBJECT_IDENTIFIER { 1.2.840.10045.3.1.7 }
      }
      [1] {
        BIT_STRING { `00` `0424bcf36eecf6b519cb16538bfba6d35fa82255abc0b1ce8d0c5153d0830277689b4d33540c39051ac82ad1c1f92583e0ffac5494c0452ab5987b7c90e216acf7` }
      }
    }
  }
}

As you can see, the inner curve inside the ECPrivateKey structure does not match the outer curve from the PKCS#8 AlgorithmIdentifier.

Guia do colaborador