ruby / ruby/openssl

"unknown signature algorithm" when trying to verify a certificate based on ECC key

Open
#557 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
276
Forks
200
Avg merge
1d 19h
Merged PRs (30d)
7

Description

Hi everyone, I don't know much about SSL understanding and I have a question because I try to verify a certifcate.
I hope someone can help me and/or maybe guide me to a solution.

Context occurs on a process of strong user authentication where I can receive either an old certificate or a new one. My code has to work with both of them.
I think I have to verify the signature of a certificate to provide this strong integrity.

I don't have any issue with the old certificate which is based on RSA Keys, but I got one with the new certificate where it is an ECC key.
At the moment I have no choice but to bypass the check on the new certificate.

The old certificate has the following lines in it (I have omitted some lines) :

Certificate:
    Data:
        Version: 3 (0x2)
        Signature Algorithm: sha256WithRSAEncryption
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    -----
                Exponent: 65537 (0x10001)

The new certificate has the following lines in it :

Certificate:
    Data:
        Version: 3 (0x2)
        Signature Algorithm: rsassaPss         
         Hash Algorithm: sha256
         Mask Algorithm: mgf1 with sha256
          Salt Length: 0x20
         Trailer Field: 0xBC (default)
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    --------
                ASN1 OID: prime256v1
                NIST CURVE: P-256

I usually execute the following command to verify the certificate : signer_certificate.verify(certificate.public_key)

I get unknown signature algorithm when I try to use this command on the new certificate.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported signer_certificate.verify(certificate.public_key) call and compare the RSA certificate details with the ECC certificate details in the issue. Trace how the Ruby OpenSSL binding handles the rsassaPss signature algorithm and id-ecPublicKey key, then reproduce the unknown signature algorithm error. Done means the reported certificate verification path no longer rejects this algorithm unexpectedly.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.