Skip to content

public_key:pkix_crl_verify/2 exception when used with EdDSA certificate #10495

@sg2342

Description

@sg2342

Describe the bug
when the Cert parameter of public_key:pkix_crl_verify/2 is a EdDSA certificate, it will call pubkey_crl:verfiy_signature/4 with invalid PublicKeyParams (ans1_NOVALUE) and throw no function clause matching public_key:ec_curve_spec(asn1_NOVALUE)

To Reproduce

# create key and selfsigned EdDSA certificate
openssl genpkey -algorithm ED25519 -out ed25519_key.pem
openssl req -x509 -new -sha512 -days 365250 -subj '/CN=ca' -key ed25519_key.pem -out ed25519_cert.pem
# minimal config and database
touch index
printf '[ ca ]\ndefault_ca = CA_default\n\n[ CA_default ]\ndatabase = index\n' > cnf
# sign (empty) CRL
openssl ca -config cnf -gencrl -keyfile ed25519_key.pem -cert ed25519_cert.pem -crldays 2300 -out ed25519_crl.pem
# verify CRL
openssl crl -verify  -CAfile ed25519_cert.pem -noout -in ed25519_crl.pem

$ erl
Erlang/OTP 28 [erts-16.2] [source] [64-bit] [smp:16:16] [ds:16:16:10] [async-threads:1] [jit:ns] [dtrace] [sharing-preserving]

Eshell V16.2 (press Ctrl+G to abort, type help(). for help)
1> %% quick and dirty way to get the DER out of a pem file
   DER = fun(FN) -> {ok, B} = file:read_file(FN), [{_, D, _}] = public_key:pem_decode(B), D end.
#Fun<erl_eval.42.113135111>
2> public_key:pkix_crl_verify(DER("./ed25519_crl.pem"), DER("./ed25519_cert.pem")).
** exception error: no function clause matching public_key:ec_curve_spec(asn1_NOVALUE) (public_key.erl:3014)
     in function  public_key:format_verify_key/1 (public_key.erl:2701)
     in call from public_key:verify/5 (public_key.erl:1603)

Expected behavior

public_key:pkix_crl_verify/2 must handle certificates with EdDSA keys

Affected versions
at least OTP25, OTP26, OTP27, OTP28

Metadata

Metadata

Assignees

Labels

bugIssue is reported as a bugteam:PSAssigned to OTP team PS

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions