Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The checking for Signature Algorithm Fields is missed for DeviceCert / AliasCert certificate models. #2658

Open
Zhiqiang520 opened this issue Apr 15, 2024 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@Zhiqiang520
Copy link
Contributor

Zhiqiang520 commented Apr 15, 2024

The checking for Signature Algorithm Fields is missed for DeviceCert / AliasCert certificate models.

  1. For DeviceCert / AliasCert certificate models, Signature Algorithm Fields is Mandatory.
    Refer to the paragraph 397 Table 42 — Field requirements In DSP0274_1.3.0.pdf.
    image

  2. But there is no checking for Signature Algorithm Fields in function libspdm_x509_common_certificate_check( ) when certificate model is DeviceCert or AliasCert.
    I think /* 3. Verify public key algorithm. */ at the following line 1083 is not the checking for Signature Algorithm Fields.

    bool libspdm_x509_common_certificate_check(const uint8_t *cert, size_t cert_size,
    uint32_t base_asym_algo, uint32_t base_hash_algo,
    bool is_requester_cert, uint8_t cert_model)
    {
    uint8_t end_cert_from[64];
    size_t end_cert_from_len;
    uint8_t end_cert_to[64];
    size_t end_cert_to_len;
    size_t asn1_buffer_len;
    bool status;
    size_t cert_version;
    size_t value;
    void *context;
    if (cert == NULL || cert_size == 0) {
    return false;
    }
    status = true;
    context = NULL;
    end_cert_from_len = 64;
    end_cert_to_len = 64;
    /* 1. version*/
    cert_version = 0;
    status = libspdm_x509_get_version(cert, cert_size, &cert_version);
    if (!status) {
    goto cleanup;
    }
    if (cert_version != 2) {
    status = false;
    goto cleanup;
    }
    /* 2. serial_number*/
    asn1_buffer_len = 0;
    status = libspdm_x509_get_serial_number(cert, cert_size, NULL, &asn1_buffer_len);
    if (asn1_buffer_len == 0) {
    status = false;
    goto cleanup;
    }
    /* 3. Verify public key algorithm. */
    status = libspdm_verify_cert_subject_public_key_info(cert, cert_size, base_asym_algo);
    if (!status) {
    goto cleanup;
    }
    /* 4. issuer_name*/
    asn1_buffer_len = 0;
    status = libspdm_x509_get_issuer_name(cert, cert_size, NULL, &asn1_buffer_len);
    if (asn1_buffer_len == 0) {
    status = false;
    goto cleanup;
    }

  3. I think maybe libspdm_x509_common_certificate_check() should call libspdm_x509_get_signature_algorithm() to get Signature Algorithm.

@jyao1 jyao1 added the bug Something isn't working label Apr 17, 2024
@jyao1 jyao1 assigned Wenxing-hou and unassigned jyao1 Apr 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants