google / google/certificate-transparency-go

Don't error on unsupported leaf public keys

Open
#531 7 comments 0 reactions 0 assignees View on GitHub
enhancement x509
Dominant language
Go
Stars
1.2k
Forks
322
Avg merge
3d 4h
Merged PRs (30d)
5

Description

crt.sh's CT monitor (which uses c-t-go) was getting stuck trying to process https://crt.sh/?id=1552595593, due to the public key's elliptic curve being unsupported.

I don't for a moment think that the patch below would form an acceptable PR; but just FYI, this is what I've done to crt.sh's local copy of c-t-go's x509.go in order to temporarily work around this problem...

```
diff --git a/x509/x509.go b/x509/x509.go
index f70a546..b9e3366 100644
--- a/x509/x509.go
+++ b/x509/x509.go
@@ -1403,7 +1403,7 @@ func parsePublicKey(algo PublicKeyAlgorithm, keyData *publicKeyInfo, nfe *NonFat
}
namedCurve := namedCurveFromOID(*namedCurveOID, nfe)
if namedCurve == nil {
- return nil, fmt.Errorf("x509: unsupported elliptic curve %v", namedCurveOID)
+ return nil, nil
}
x, y := elliptic.Unmarshal(namedCurve, asn1Data)
if x == nil {
```

Contributor guide

Open the contributing guide

Research direction

Start in x509/x509.go at parsePublicKey, especially the namedCurveFromOID path shown in the report, and inspect how the certificate at crt.sh/?id=1552595593 is processed. Reproduce the unsupported-curve case and determine the expected non-blocking behavior; done means the CT monitor can process that certificate without the current unsupported-curve error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.