3.0.8 breaks PKITS test 4.1.5 (which requires DSA parameter inheritance)
Open
Nobody has claimed this yet.
branch: 3.0
branch: 3.1
branch: 3.2
branch: master
triaged: bug
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
Indeed, just decoding the certificate fails:
openssl x509 -noout -text -in ValidDSAParameterInheritanceTest5EE.crt
The output includes
Subject Public Key Info:
Public Key Algorithm: dsaEncryption
Unable to load Public Key
40477373937F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
40477373937F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
X509v3 extensions:
(Version 1.1.1t does not seem affected.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with openssl x509 -noout -text -in ValidDSAParameterInheritanceTest5EE.crt and compare the behavior with version 1.1.1t. Trace the X509 public-key decoding path around the reported x_pubkey.c:458 error and the PKITS 4.1.5 DSA parameter-inheritance case. Done means the certificate decodes successfully and PKITS test 4.1.5 passes without regressing other DSA cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100