EC P256 Certificate Signing Requests are Broken

[dainnilsson]

Originally opened as Yubico/yubikey-piv-manager#1. Content copied below:

Whenever I have the tool generate a CSR using ECC P256, the generated CSR is invalid. The issue appears to be with the ECDSA signature on the certificate request, which appears to be stored incorrectly:

Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: DC=net, DC=voria, DC=token, CN=Yubikey NEO 35XXXXX
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
            EC Public Key: 
                pub: 
                    04:dd:91:86:6a:92:69:90:d9:cd:f0:81:ca:a3:40:
                    80:d8:64:e3:ad:13:3a:ed:43:0e:42:a0:95:b2:1e:
                    8c:2c:46:60:f3:5b:75:33:92:38:51:52:b8:6c:0c:
                    1a:b8:b0:6f:ee:f1:33:7a:9a:37:a8:79:d7:c8:de:
                    19:92:43:23:83
                ASN1 OID: prime256v1
        Attributes:
            a0:00
    Signature Algorithm: ecdsa-with-SHA256
        30:46:02:21:00:c3:7d:49:a6:da:e9:fe:25:18:26:7d:20:3e:
        6a:80:22:04:a4:9d:a8:fb:72:9a:7c:99:c5:48:02:e2:28:0b:
        65:02:21:00:d6:58:07:d0:f5:a5:f9:d9:f1:53:49:5d:3b:8a:
        5c:75:87:66:43:32:da:ce:97:67:33:0d:9b:8e:78:54:3a:17
Check that the request matches the signature
Signature verification problems....
20298:error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm:/SourceCache/OpenSSL098/OpenSSL098-52.30.1/src/crypto/asn1/a_verify.c:164:

[klali]

I can't reproduce this:

$ yubico-piv-tool -a generate -A ECCP256 -s 9a -o pub
$ yubico-piv-tool -a verify -a request -s 9a -P 123456 -S '/CN=test/' -i pub -o req
Successfully verified PIN.
Successfully generated a certificate request.
$ openssl req -verify -in req -noout
verify OK

[klali]

@darconeous what command did you use to verify the request?

[darconeous]

I was actually just trying to generate a signed certificate using the CSR. The exact same commands work fine when I'm using RSA. I'll check when I get back to my personal computer what the exact commands were and what openssl req -verify -in req -noout says.

Note that this was on OS X.

[darconeous]

So...

$ openssl req -verify -noout -in ~/Desktop/Untitled.csr 
34882:error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/crypto/asn1/a_verify.c:164:

Which seems pretty weird.

Using the non-stock version of OpenSSL, everything seems fine:

$ /usr/local/Cellar/openssl/1.0.2d/bin/openssl req -verify -noout -in ~/Desktop/Untitled.csr 
verify OK

Seems like it might be a bug in the OS X version of OpenSSL...?

[mouse07410]

Nothing weird at all. Checking on my Mac reveals:

$ /usr/bin/openssl version
OpenSSL 0.9.8zg 14 July 2015
$ /opt/local/bin/openssl version
OpenSSL 1.0.2d 9 Jul 2015
$

This means that the Apple-installed version of OpenSSL in Mac OS X up to and including Yosemite is an ancient one that probably does not support either ECC or hashes from SHA-2 family.

Which is why people usually choose to install a newer OpenSSL, either manually or using a package manager like Macports or Homebrew.

On Oct 10, 2015, at 15:50 , Robert Quattlebaum <notifications@github.commailto:notifications@github.com> wrote:

So...

$ openssl req -verify -noout -in ~/Desktop/Untitled.csr
34882:error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/crypto/asn1/a_verify.c:164:

Which seems pretty weird.

Using the non-stock version of OpenSSL, everything seems fine:

$ /usr/local/Cellar/openssl/1.0.2d/bin/openssl req -verify -noout -in ~/Desktop/Untitled.csr
verify OK

Seems like it might be a bug in the OS X version of OpenSSL...?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/27#issuecomment-147120518.

Uri Blumenthal
uri@mit.edumailto:uri@mit.edu

[klali]

So the shipped openssl with OS X is really old (0.9.8) since this seems to be a bug there I'm just going to close this. Thanks for the analysis @mouse07410

[mouse07410]

It looks like Apple did some interesting things with OpenSSL-0.9.8zg, including addition of ECC and SHA-2 support to it. I was too hasty conjecturing that it wasn't there.

Still, if the newer-than-0.9.8 OpenSSL works correctly with those keys, it would be enough indication for me that the problem is in the 0.9.8 version of OpenSSL...