Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: ParsePKIXPublicKey parses invalid RSA public keys without errors #16166

Closed
szank opened this issue Jun 23, 2016 · 2 comments
Closed

crypto/x509: ParsePKIXPublicKey parses invalid RSA public keys without errors #16166

szank opened this issue Jun 23, 2016 · 2 comments
Assignees
Milestone

Comments

@szank
Copy link

@szank szank commented Jun 23, 2016

Please answer these questions before submitting your issue. Thanks!

  1. What version of Go are you using (go version)?
    go version go1.6.2 darwin/amd64
  2. What operating system and processor architecture are you using (go env)?
GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/mgalkowski/work/go"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.6.2/libexec"
GOTOOLDIR="/usr/local/Cellar/go/1.6.2/libexec/pkg/tool/darwin_amd64"
GO15VENDOREXPERIMENT="1"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fno-common"
CXX="clang++"
CGO_ENABLED="1"
  1. What did you do?
    If possible, provide a recipe for reproducing the error.
    A complete runnable program is good.
    A link on play.golang.org is best.
    https://play.golang.org/p/qMQ1aqX5Ox
  2. What did you expect to see?
    Last line should say:
    Error parsing incorrect RSA public key
  3. What did you see instead?
    INCORRECT public key have been parsed

According to
RFC3279 https://tools.ietf.org/html/rfc3279#section-2.3.1 :

The rsaEncryption OID is intended to be used in the algorithm field
of a value of type AlgorithmIdentifier.  The parameters field MUST
have ASN.1 type NULL for this algorithm identifier.

Could you please fix it ?

@szank
Copy link
Author

@szank szank commented Jun 23, 2016

I am happy to fix it myself if I find some time this weekend.

@ianlancetaylor ianlancetaylor changed the title crypto/x509 ParsePKIXPublicKey parses invalid RSA public keys without errors crypto/x509: ParsePKIXPublicKey parses invalid RSA public keys without errors Jun 23, 2016
@ianlancetaylor ianlancetaylor added this to the Go1.8 milestone Jun 23, 2016
@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jun 23, 2016

CC @agl

@agl agl self-assigned this Jun 23, 2016
@gopherbot gopherbot closed this in 59aeac2 Aug 17, 2016
joeshaw added a commit to fastly/go-utils that referenced this issue Mar 6, 2017
This meant regenerating a lot of certs.  For background,
golang/go#16166.
@golang golang locked and limited conversation to collaborators Aug 17, 2017
FiloSottile pushed a commit to FiloSottile/go that referenced this issue Oct 12, 2018
The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA
public key must be NULL. BoringSSL enforces this so we have strong
evidence that this is a widely compatible change.

Embarrassingly enough, the major source of violations of this is us. Go
used to get this correct in only one of two places. This was only fixed
in 2013 (with 4874bc9). That's why lots of test certificates are
updated in this change.

Fixes golang#16166.

Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab
Reviewed-on: https://go-review.googlesource.com/27312
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
FiloSottile pushed a commit to FiloSottile/go that referenced this issue Oct 12, 2018
The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA
public key must be NULL. BoringSSL enforces this so we have strong
evidence that this is a widely compatible change.

Embarrassingly enough, the major source of violations of this is us. Go
used to get this correct in only one of two places. This was only fixed
in 2013 (with 4874bc9). That's why lots of test certificates are
updated in this change.

Fixes golang#16166.

Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab
Reviewed-on: https://go-review.googlesource.com/27312
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.