You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Current certificate creation code for the DPE Leaf certificate treats the KeyIdentifier field (tag [0]) of the AuthorityKeyIdentifier extension as EXPLICIT instead of IMPLICIT. This causes verification of the leaf certificate to fail because the OCTET STRING tag and length are interpreted as part of the KeyIdentifier.
I had opened #325 earlier to track this but closed it since the go x.509 parsers in verification/ were working with and without adding the extraneous bytes so I wasn't sure how big of an issue it would be. Further, the Rust X.509 parser fails if we try to make these structures implicit, so I left it as is.
Current certificate creation code for the DPE Leaf certificate treats the KeyIdentifier field (tag [0]) of the AuthorityKeyIdentifier extension as EXPLICIT instead of IMPLICIT. This causes verification of the leaf certificate to fail because the OCTET STRING tag and length are interpreted as part of the KeyIdentifier.
Incorrect:
X509v3 Authority Key Identifier:
keyid:04:14:E2:46:2E:61:DC:1F:DA:C3:25:82:06:72:AE:B0:8D:15:A8:61:79:A8
Correct:
X509v3 Authority Key Identifier:
keyid:FC:B4:9F:26:61:71:77:99:1B:E6:DC:70:E6:E8:17:D6:24:A4:A4:1B
I modified a test in the Caliptra sw repo to explore this behavior but a test should be added to the DPE repo to check the cert chain.
The text was updated successfully, but these errors were encountered: