Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

X509 X509_STORE_CTX_set_verify_cb support #2220

Open
Fethbita opened this issue Apr 14, 2024 · 0 comments
Open

X509 X509_STORE_CTX_set_verify_cb support #2220

Fethbita opened this issue Apr 14, 2024 · 0 comments

Comments

@Fethbita
Copy link

Fethbita commented Apr 14, 2024

Hi, I am verifying ICAO CSCA certificates as shown in tests however because of the way ICAO Doc 9303-12 defines the EC public keys:

Those issuing States or organizations implementing ECDSA for signature generation or verification SHALL use [X9.62]
or [ISO/IEC 15946]. The elliptic curve domain parameters used to generate the ECDSA key pair MUST be described
explicitly in the parameters of the public key, i.e. parameters MUST be of type ECParameters (no named curves, no
implicit parameters) and MUST include the optional co-factor. ECPoints MUST be in uncompressed format.

I must support the explicit parameters in the public keys. Currently, when I try to verify a certificate, I get Certificate public key has explicit ECC parameters error. In openssl issue number 20117 (openssl/openssl#20117 (comment)), a solution to use X509_STORE_CTX_set_verify_cb was recommended. Indeed, if I could set this callback I could search for this error and continue parsing. Relevant lines in openssl are x509_vfy.c#172 and x509_vfy.c#570 where the check itself happens. Is there a possibility of exposing this function?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant