crypto/x509: Parse CSR not containing Extensions Request Attribute

[TheJimmyBlaze]

What version of Go are you using (go version)?

$ go version
go version go1.18.4 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOOS="linux"
GOARCH="amd64"
GOHOSTOS="linux"
GOHOSTARCH="amd64"

What did you do?

Attempt to parse a CSR PEM that does not contain an Extensions Request Attribute ( 1.2.840.113549.1.9.14 ).
The PKCS10 RFC doesn't specifically state that a PKCS10 must have, or may not have an Extension Request Attribute.
However the x509 RFC does state that:
If present, this field is a SEQUENCE of one or more certificate extensions.
I would expect that I must only include an Extension Request Attribute, when it contains one or more extensions.

Go Play demo:
https://go.dev/play/p/6YJ2CxnKtIw

What did you expect to see?

An x509.CertificateRequest struct with an empty array of pkix.Extension structs.

What did you see instead?

The error:
asn1: syntax error: sequence truncated

[seankhliao]

cc @FiloSottile @golang/security

[rolandshoemaker]

The ASN.1 syntax for the CertificateRequestInfo object does not mark attributes as OPTIONAL, and as such it is required, even if it is empty.

   CertificationRequestInfo ::= SEQUENCE {
        version       INTEGER { v1(0) } (v1,...),
        subject       Name,
        subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
        attributes    [0] Attributes{{ CRIAttributes }}
   }

In the two examples you provide, one has attributes containing a extensionRequest attribute, and one is completely missing the attributes field. We support CSRs that lack extensionRequest (i.e. https://go.dev/play/p/zFkdR60fy8B), but they still must contain an empty attributes SET.

Closing since this is working as intended.

[TheJimmyBlaze]

Thanks for the clarification.