Cryptic Rumblings Ahead of First 2020 Patch Tuesday

Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by fulafel on Tuesday January 14, 2020 @12:31AM (#22042128)

Do we know that MS TLS implementation parses self-signed certs only after successful validation? Many implementations offer an option of showing their contents (eg to see what CA it claims to be signed by), or offer the user a choice to accept it, or log identifying fields from the cert for diagnostic purpouses. Same for the CA server offered CA chain.

I'm also not convinced that the fields-allowed-by-CAs set is safe, especially when you consider the set of all browser-accepted CAs, it's historically been a fraught field.

Also with x.509 you have to decode the ASN.1 before you can even get to the signature, there have been historically been lots of vulnerabilities in ASN.1 parsers.

[ Parent | on HN ]

Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by cjbprime on Tuesday January 14, 2020 @02:08AM (#22042539)

> Do we know that MS TLS implementation parses self-signed certs only after successful validation?

It would be a contradiction in terms. You can't validate the semantic content of a file before you've parsed it!

[ Parent | on HN ]

Re:Cryptic Rumblings Ahead of First 2020 Patch Tuesday by fulafel on Tuesday January 14, 2020 @04:51AM (#22043310)

Yeah, I should have said "before it processes any other fields". The ASN.1 parse of course comes first.

[ Parent | on HN ]