Bugtraq mailing list archives
Re: Windows doesn't verify digital signature of CRL files
From: Thomas Walpuski <thomas-bugtraq () unproved org>
Date: Wed, 11 Aug 2004 06:52:34 +0000
* Jack Lloyd wrote:
If Windows is not checking the signature, not only can you remove or alter revocations, you can also add ones.
Microsoft's CryptoAPI does check the CRL's signature. It just does not check it on retrieval, but in the process of verifying certificates.
Oddly, I couldn't find any language in RFC 3280 that actually requires verifying the signature in a CRL. Strange.
RFC 3280, 6.3.3 CRL Processing: For each distribution point (DP) in the certificate CRL distribution points extension, for each corresponding CRL in the local CRL cache, while ((reasons_mask is not all-reasons) and (cert_status is UNREVOKED)) perform the following: [..] (f) Obtain and validate the certification path for the complete CRL issuer. If a key usage extension is present in the CRL issuer's certificate, verify that the cRLSign bit is set. (g) Validate the signature on the complete CRL using the public key validated in step (f). That's almost exactly what Microsoft's CryptoAPI does. Thomas Walpuski
Current thread:
- Windows doesn't verify digital signature of CRL files Faro Poplar (Aug 09)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Neil Gierman (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Jack Lloyd (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 11)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Neil Gierman (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Valdis . Kletnieks (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- <Possible follow-ups>
- Windows doesn't verify digital signature of CRL files Michael Howard (Aug 11)