Bug 671266

Summary: CMS can't verify signed data when the SignerInfo indicates the signer by subjectKeyID
Product: Red Hat Enterprise Linux 6 Reporter: Nalin Dahyabhai <nalin>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED ERRATA QA Contact: Aleš Mareček <amarecek>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.0CC: amarecek, dpal, rrelyea, syeghiay
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-3.12.10-14.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-12-06 12:08:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 668887, 750914    
Attachments:
Description Flags
automated test none

Description Nalin Dahyabhai 2011-01-20 22:18:28 UTC 
Description of problem:
NSS's CMS routines can't verify signed data when the SignerInfo in the signed data indicates the signer ID using the subject key identifier.

Version-Release number of selected component (if applicable):
nss-3.12.9-1

How reproducible:
Always

Steps to Reproduce:
1. openssl cms -cmsout -sign -nodetach -keyid -outform der -signer key-and-cert.pem -in /etc/issue > signed3
2. cmsutil -d db/dir -D -i signed3
  
Actual results:
signer 0 status = SigningCertNotFound
cmsutil: problem decoding: Unrecognized Object Identifier.

Expected results:
The contents of /etc/issue reproduced.

Additional info:
This looks to be caused by an error locating the signer's certificate, despite it being contained in the message.
Comment 2 Bob Relyea 2011-01-21 01:30:27 UTC 
This may be related to upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=602509 ?

bob
Comment 3 Nalin Dahyabhai 2011-01-21 15:34:10 UTC 
Yes, it reads to me as being the same.
Comment 5 RHEL Program Management 2011-04-04 02:13:02 UTC 
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 7 Elio Maldonado Batiz 2011-08-15 17:23:54 UTC 
Picking up the patch from upstream.
Comment 26 errata-xmlrpc 2011-12-06 12:08:30 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1584.html