csr verification with openssl gives error for ed25519 certificates

Open
  • Is something wrong?
#11 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
rust
Domain
cryptography, security

Research direction

Start in tests/openssl.rs by uncommenting verify_csr(&cert) in test_openssl_25519_given and running that test to reproduce the OpenSSL ASN.1 and EC_PRIVATEKEY error. Trace the verification path from there. Done means Ed25519 CSR verification succeeds without the panic and the test passes.

Written by the indexing model from the issue text.

Description

In tests/openssl.rs, invocation of the verify_csr(&cert); function is commented out for ed25519 certificates because it fails. I'm not sure what the problem is.

This is the output if you remove the //:

---- test_openssl_25519_given stdout ----
-----BEGIN CERTIFICATE-----
MIIBLzCB4qADAgECAgEqMAUGAytlcDAsMSowFgYDVQQKDA9DcmFiIHdpZGdpdHMg
U0UwEAYDVQQDDAlNYXN0ZXIgQ0EwIhgPMTk3NTAxMDEwMDAwMDBaGA80MDk2MDEw
MTAwMDAwMFowLDEqMBYGA1UECgwPQ3JhYiB3aWRnaXRzIFNFMBAGA1UEAwwJTWFz
dGVyIENBMCowBQYDK2VwAyEA67x/8fDcfbp7bLnOhE/nHt8Oz0ri2PAS1nB3Vwxr
5ECjJTAjMCEGA1UdEQQaMBiCC2NyYWJzLmNyYWJzgglsb2NhbGhvc3QwBQYDK2Vw
A0EANUf5PpvKy0FIAHybycyZZViPYXndWjFMPSLMH9qNmKo3VnsCwjWlboetGT6i
j3popEMaJ8nhDP4AAqo+/c/vDA==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE REQUEST-----
MIHiMIGVAgEAMC4xGDAWBgNVBAoMD0NyYWIgd2lkZ2l0cyBTRTESMBAGA1UEAwwJ
TWFzdGVyIENBMCowBQYDK2VwAyEA67x/8fDcfbp7bLnOhE/nHt8Oz0ri2PAS1nB3
Vwxr5ECgNDAyBgkqhkiG9w0BCQ4xJTAjMCEGA1UdEQQaMBiCC2NyYWJzLmNyYWJz
gglsb2NhbGhvc3QwBQYDK2VwA0EAbXjjM1CwFLPPCMRDNtt0SnVLvD7gv70Hj9TA
UWb1oFnKmIu9qQOXOW7xb5YHGcwPyo0zTpBU5vukDFkraojhDg==
-----END CERTIFICATE REQUEST-----

thread 'test_openssl_25519_given' panicked at 'called `Result::unwrap()` on an `Err` value: ErrorStack([Error { code: 218529960, library: "asn1 encoding routines", function: "asn1_check_tlen", reason: "wrong tag", file: "../crypto/asn1/tasn_dec.c", line: 1130 }, Error { code: 218546234, library: "asn1 encoding routines", function: "asn1_d2i_ex_primitive", reason: "nested asn1 error", file: "../crypto/asn1/tasn_dec.c", line: 694 }, Error { code: 218640442, library: "asn1 encoding routines", function: "asn1_template_noexp_d2i", reason: "nested asn1 error", file: "../crypto/asn1/tasn_dec.c", line: 627, data: "Field=privateKey, Type=EC_PRIVATEKEY" }, Error { code: 269033488, library: "elliptic curve routines", function: "d2i_ECPrivateKey", reason: "EC lib", file: "../crypto/ec/ec_asn1.c", line: 899 }, Error { code: 269344910, library: "elliptic curve routines", function: "old_ec_priv_decode", reason: "decode error", file: "../crypto/ec/ec_ameth.c", line: 447 }, Error { code: 218529960, library: "asn1 encoding routines", function: "asn1_check_tlen", reason: "wrong tag", file: "../crypto/asn1/tasn_dec.c", line: 1130 }, Error { code: 218640442, library: "asn1 encoding routines", function: "asn1_template_noexp_d2i", reason: "nested asn1 error", file: "../crypto/asn1/tasn_dec.c", line: 553, data: "Field=attributes, Type=PKCS8_PRIV_KEY_INFO" }])', src/libcore/result.rs:997:5
note: Run with `RUST_BACKTRACE=1` environment variable to display a backtrace.

cc @djc

Dominant language
Rust
Stars
516
Forks
160
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rustls/rcgen

All issues in rustls/rcgen

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.