Test case 1: self-signed cases whenever cmc.cfg file has request.selfSign=true , and signing algorithm is EC( as in crmfpopclient cli we use -a ec) throws org.mozilla.jss.crypto.InvalidKeyFormatException.
1.CRMFPopClient -d /root/help -p <password> -n UID=testuser1self-Test1 -q POP_SUCCESS -b /root/transport.pem -a ec -t false -y -w "AES/CBC/PKCS5Padding" -o crmf2.req 2. Run CMCRequest file with request.selfSign=true. 3. Run HttpClient.Below are the debug logs
[04/May/2018:07:25:41][http-bio-20443-exec-16]: CMCUserSignedAuth: authenticate: signing key alg=EC [04/May/2018:07:25:41][http-bio-20443-exec-16]: CMCUserSignedAuth: authenticate: org.mozilla.jss.crypto.InvalidKeyFormatException: Unable to decode DER-encoded SubjectPublicKeyInfo: invalid DER encoding [04/May/2018:07:25:41][http-bio-20443-exec-16]: SignedAuditLogger: event CMC_USER_SIGNED_REQUEST_SIG_VERIFY [04/May/2018:07:25:41][http-bio-20443-exec-16]: ProfileSubmitCMCServlet: authenticate: org.mozilla.jss.crypto.InvalidKeyFormatException: Unable to decode DER-encoded SubjectPublicKeyInfo: invalid DER encoding [04/May/2018:07:25:41][http-bio-20443-exec-16]: SignedAuditLogger: event AUTH [04/May/2018:07:25:41][http-bio-20443-exec-16]: CMCOutputTemplate: getContentInfo: begins [04/May/2018:07:25:41][http-bio-20443-exec-16]: CMCOutputTemplate: getContentInfo: - done [04/May/2018:07:25:41][http-bio-20443-exec-16]: SignedAuditLogger: event CMC_RESPONSE_SENT [04/May/2018:07:25:41][http-bio-20443-exec-16]: ProfileSubmitCMCServlet: authentication error org.mozilla.jss.crypto.InvalidKeyFormatException: Unable to decode DER-encoded SubjectPublicKeyInfo: invalid DER encoding
Steps to Reproduce:
1.Install ECC RootCA. 2.Run CRMFPopClient -d /root/help -p <password> -n UID=testuser1self-Test1 -q POP_SUCCESS -b /root/transport.pem -a ec -t false -y -w "AES/CBC/PKCS5Padding" -o crmf2.req 3. Make sure it's for self signed and -a is ec in crmfpopclient
Actual results:
Failures caused due to: [04/May/2018:07:25:41][http-bio-20443-exec-16]: CMCUserSignedAuth: authenticate: org.mozilla.jss.crypto.InvalidKeyFormatException: Unable to decode DER-encoded SubjectPublicKeyInfo: invalid DER encoding
Expected results:
Should work.
Additional info:
In Case we have signing algorithm as RSA in crmfpopclient,it works. ===================================================== CRMFPopClient -d /root/help -p <password> -n UID=testuser1self-Test1 -q POP_SUCCESS -b /root/transport.pem -y -w "AES/CBC/PKCS5Padding" -o crmf2.req [04/May/2018:07:40:57][http-bio-20443-exec-17]: CMCUserSignedAuth: authenticate: signing key alg=RSA [04/May/2018:07:40:57][http-bio-20443-exec-17]: CMCUserSignedAuth: authenticate: public key retrieved [04/May/2018:07:40:57][http-bio-20443-exec-17]: CMCUserSignedAuth: verifySelfSignedCMC: begins
Metadata Update from @mharmsen: - Custom field component adjusted to None - Custom field feature adjusted to None - Custom field origin adjusted to None - Custom field proposedmilestone adjusted to None - Custom field proposedpriority adjusted to None - Custom field reviewer adjusted to None - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1580394 - Custom field type adjusted to None - Custom field version adjusted to None
Metadata Update from @mharmsen: - Issue priority set to: blocker (was: critical)
commit 33f532f435672e712c041e17ed8597bf96d30526 (HEAD -> master, origin/master, origin/HEAD) Author: Christina Fu cfu@redhat.com Date: Mon Jun 4 11:03:20 2018 -0700
Ticket 3028 additional error checking Change-Id: If660fabd21b9992416dd1d5463b6ffd68fa1bf43
commit bd9365250ac1f98505823d7d47476b5f814cfb58 Author: Christina Fu cfu@redhat.com Date: Mon Jun 4 10:53:12 2018 -0700
Ticket 3028 CMC CRMF request results in InvalidKeyFormatException when signing algorithm is ECC This patch fixes the issue where in case of CRMF request with ECC keys the public key was encoded incorrectly previously. The fix was done in a way that RSA portion is unaffected. Fixes https://pagure.io/dogtagpki/issue/3028 Change-Id: I3eb62638f2970dc7a9df37abb19015bd287b383d
Metadata Update from @cfu: - Issue close_status updated to: fixed - Issue set to the milestone: 10.5.9 (was: 10.5) - Issue status updated to: Closed (was: Open)
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/3146
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.