-
Notifications
You must be signed in to change notification settings - Fork 3k
Open
Labels
bugIssue is reported as a bugIssue is reported as a bugteam:PSAssigned to OTP team PSAssigned to OTP team PS
Description
Describe the bug
when the Cert parameter of public_key:pkix_crl_verify/2 is a EdDSA certificate, it will call pubkey_crl:verfiy_signature/4 with invalid PublicKeyParams (ans1_NOVALUE) and throw no function clause matching public_key:ec_curve_spec(asn1_NOVALUE)
To Reproduce
# create key and selfsigned EdDSA certificate
openssl genpkey -algorithm ED25519 -out ed25519_key.pem
openssl req -x509 -new -sha512 -days 365250 -subj '/CN=ca' -key ed25519_key.pem -out ed25519_cert.pem
# minimal config and database
touch index
printf '[ ca ]\ndefault_ca = CA_default\n\n[ CA_default ]\ndatabase = index\n' > cnf
# sign (empty) CRL
openssl ca -config cnf -gencrl -keyfile ed25519_key.pem -cert ed25519_cert.pem -crldays 2300 -out ed25519_crl.pem
# verify CRL
openssl crl -verify -CAfile ed25519_cert.pem -noout -in ed25519_crl.pem
$ erl
Erlang/OTP 28 [erts-16.2] [source] [64-bit] [smp:16:16] [ds:16:16:10] [async-threads:1] [jit:ns] [dtrace] [sharing-preserving]
Eshell V16.2 (press Ctrl+G to abort, type help(). for help)
1> %% quick and dirty way to get the DER out of a pem file
DER = fun(FN) -> {ok, B} = file:read_file(FN), [{_, D, _}] = public_key:pem_decode(B), D end.
#Fun<erl_eval.42.113135111>
2> public_key:pkix_crl_verify(DER("./ed25519_crl.pem"), DER("./ed25519_cert.pem")).
** exception error: no function clause matching public_key:ec_curve_spec(asn1_NOVALUE) (public_key.erl:3014)
in function public_key:format_verify_key/1 (public_key.erl:2701)
in call from public_key:verify/5 (public_key.erl:1603)
Expected behavior
public_key:pkix_crl_verify/2 must handle certificates with EdDSA keys
Affected versions
at least OTP25, OTP26, OTP27, OTP28
Metadata
Metadata
Assignees
Labels
bugIssue is reported as a bugIssue is reported as a bugteam:PSAssigned to OTP team PSAssigned to OTP team PS