Bug 1575725
| Summary: | JSS has wrong encoding for ecdsa with sha* AlgorithmIdentifier | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Christina Fu <cfu> | ||||
| Component: | jss | Assignee: | Christina Fu <cfu> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> | ||||
| Severity: | high | Docs Contact: | Marc Muehlfeld <mmuehlfe> | ||||
| Priority: | high | ||||||
| Version: | 7.6 | CC: | akahat, jmagne, mharmsen, msauton | ||||
| Target Milestone: | rc | Keywords: | TestCaseProvided, ZStream | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
See Doc Text field in BZ#1579202.
|
Story Points: | --- | ||||
| Clone Of: | |||||||
| : | 1579202 (view as bug list) | Environment: | |||||
| Last Closed: | 2018-10-30 11:00:36 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1547802, 1579202 | ||||||
| Attachments: |
|
||||||
|
Description
Christina Fu
2018-05-07 18:37:28 UTC
Test procedure: Note, this could be tested with https://bugzilla.redhat.com/show_bug.cgi?id=1547802 No need to test it twice. Se see the following for test procedure: https://bugzilla.redhat.com/show_bug.cgi?id=1547802#c2 Created attachment 1437492 [details]
this patch makes sure no params are in the Algorithm ID in case of signature with ECDSA with various SHA*
Comment on attachment 1437492 [details]
this patch makes sure no params are in the Algorithm ID in case of signature with ECDSA with various SHA*
Looks good. We will have to keep an eye in the future if we need more algs added to this thing.
commit a8e371e54b009159e9e3a0d198bd5eb3ed68ac22 (HEAD -> master, origin/master, origin/HEAD, ticket-3-AlgId)
Author: Christina Fu <cfu>
Date: Tue May 15 14:58:07 2018 -0700
Ticket 3 JSS has wrong encoding for ecdsa with sha* AlgorithmIdentifier
This ticket addresses the issue to meet RFC 5758 where param field must be omitted
in the ECDSA Signature algorithm' AlgorithmIdentifier for
ecdsa-withSHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or ecdsa-with-SHA512.
fixes https://pagure.io/jss/issue/3
I tested this Bugzilla on version: 10.5.9-5.el7
Steps I followed:
- Setup ECC CA, KRA
- Create a CMC request and submit per CMC enrollment procedure
- I use the dumpasn1 tool on the response and check that 'OBJECT IDENTIFIER ecdsaWithSHA256 (1 2 840 10045 4 3 2)' block do not have NULL.
- For more verification, I copied enrolled b64 certificate and ran the dunpasn1 tool on that.
- It does not show the NULL in ecdsaWithSHA256 block.
```
16 10: . . SEQUENCE {
<06 08 2A 86 48 CE 3D 04 03 02>
18 8: . . . OBJECT IDENTIFIER ecdsaWithSHA256 (1 2 840 10045 4 3 2)
: . . . . (ANSI X9.62 ECDSA algorithm with SHA256)
: . . . }
```
Verifying this Bugzilla.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3188 |