1183181 - CertBlocklist should remove leading zeros before making comparisons on serial numbers

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Mark Goodwin [:mgoodwin]]

We retain leading zeros when reading integer data from asn.1 structures. Other people's libraries do not (e.g. openssl, Go's x509 library). This means when we perform comparisons on, e.g, serial numbers on data prepared elsewhere, we can have problems.

The right thing to do seems to be to strip the leading zeros in the CertBlocklist revocation check.

Comment 1

[Mark Goodwin [:mgoodwin]]

From talking to Keeler, the least bad thing to do here is to fix this in tooling.