openssl/openssl

OpenSSL accepts PKCS#8 elliptic curve private key with inconsistent OIDs

Open

#26,471 创建于 2025年1月19日

在 GitHub 查看
 (2 评论) (0 反应) (0 负责人)C (11,262 fork)batch import
help wantedtriaged: feature

仓库指标

Star
 (30,157 star)
PR 合并指标
 (30 天内没有已合并 PR)

描述

~ ❯❯❯ pbpaste 
-----BEGIN PRIVATE KEY-----
MIGQAgEAMBAGByqGSM49AgEGBSuBBAAiBHkwdwIBAQQgYirTZSx+5O8Y6tlGcka6
W6btJiocdrdolfcukSoTEk+gCgYIKoZIzj0DAQehRANCAAQkvPNu7Pa1GcsWU4v7
ptNfqCJVq8Cxzo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDi
Fqz3
-----END PRIVATE KEY-----
~ ❯❯❯ pbpaste | openssl pkcs8 -nocrypt
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYirTZSx+5O8Y6tlG
cka6W6btJiocdrdolfcukSoTEk+hRANCAAQkvPNu7Pa1GcsWU4v7ptNfqCJVq8Cx
zo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDiFqz3
-----END PRIVATE KEY-----
~ ❯❯❯ pbpaste | der2ascii -pem
SEQUENCE {
  INTEGER { 0 }
  SEQUENCE {
    # ecPublicKey
    OBJECT_IDENTIFIER { 1.2.840.10045.2.1 }
    # secp384r1
    OBJECT_IDENTIFIER { 1.3.132.0.34 }
  }
  OCTET_STRING {
    SEQUENCE {
      INTEGER { 1 }
      OCTET_STRING { `622ad3652c7ee4ef18ead9467246ba5ba6ed262a1c76b76895f72e912a13124f` }
      [0] {
        # secp256r1
        OBJECT_IDENTIFIER { 1.2.840.10045.3.1.7 }
      }
      [1] {
        BIT_STRING { `00` `0424bcf36eecf6b519cb16538bfba6d35fa82255abc0b1ce8d0c5153d0830277689b4d33540c39051ac82ad1c1f92583e0ffac5494c0452ab5987b7c90e216acf7` }
      }
    }
  }
}

As you can see, the inner curve inside the ECPrivateKey structure does not match the outer curve from the PKCS#8 AlgorithmIdentifier.

贡献者指南