216116 - NSS fails NIST test for cert with optional isserUniqueID

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P1)

Description

[Nelson Bolyard (seldom reads bugmail)]

X.509 v2 introduced two new optional components to a certificate.  
The optional issuerUniqueID and subjectUniqueID components come after the
subjectPublicKeyInfo and before the extensions.  These optional components are
also part of the definition of an X.509 v3 cert, although rarely used.
Each uniqueID is a bitstring.

The new NIST test suite includes one or more certs that contain these optional
UniqueIdentifier components.  NSS can't parse them.  

This should be easy to fix, I think.  Just two new optional components in the 
template that are bitstrings.  The tricky part is likely to be finding a place
in the CERTCertificate structure for them.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: cert that cannot be parsed (binary)

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

See RFC 3280 page 15 for the relevant ASN.1 syntax.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

This bug is the reason that NSS fails NIST test 4.3.6 
also known as "Valid Name Chaining UIDs Test6"

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v1

AAARGH!  The cause of this bug was SO STUPID.
The unique IDs are NOT OIDS, they're bit strings, and they're not
typically constructed, so we must not require that they be constructed.
The CERTCertificate structure already has places to store them, so binary
compatibility is not an issue.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 139102 [details] [diff] [review]
patch v1

Please review.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Add requested reviewers to cc list

Comment 7

[Wan-Teh Chang]

Comment on attachment 139102 [details] [diff] [review]
patch v1

Nelson, since our ASN.1 decoder expert Julien has
reviewed your patch, you can go ahead and check it
in.  I'll review the patch tomorrow.  (May need to
ask Bob to review it instead because I'm not familiar
with our ASN.1 templates.)

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

/cvsroot/mozilla/security/nss/lib/certdb/certdb.c,v  <--  certdb.c
new revision: 1.60; previous revision: 1.59

Comment 9

[Robert Relyea]

Comment on attachment 139102 [details] [diff] [review]
patch v1

yes, looks good

Comment 10

[Bishakha Banerjee]

Marking VERIFIED.

Valid Name Chaining UIDs Test 6 (Test 4.3.6) passes.