211523 - certutil unnecessarily requires login to verify cert signature

Status: RESOLVED DUPLICATE of bug 326637

(NSS :: Tools, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

I tried to verify a cert chain with a command like this one:

./certutil.exe -V -d dbdir -n "Server-Cert" -e -u R

certutil insisted that I login, but I didn't have the password for the key
DB, and so could not login.

However, using the debugger, I simply skipped the call to PK11_Authenticate
(certutil.c about line 2724), and then certutil completed the cert chain
verification without any problem.  

Clearly, the authentication was not actually necessary.  
So, why did certutil require it?  
The commend says it's for FIPS, but 
a) I'm not sure that it's really required for FIPS, and 
b) my token wasn't in FIPS mode.

An ordinary user couldn't have gotten past the authenticate call the way 
I did.  This is an issue, now that certutil is being shipped with 
certain products.

Comment 1

[Wan-Teh Chang]

Seems that we should only call PK11_Authenticate when
the token is in FIPS mode, and then find out whether
it's really required for FIPS.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Bob,  
You've recently done work on NSS to eliminate unnecessary authentications.
This bug (one year old tomorrow) reports another instance of that problem,
and it is not fixed by your recent changes.
Please fix this bug also, as part of that work to eliminate unnecessary
authentications.

Comment 3

[Julien Pierre]

Is it perhaps the case that we force an authentication in order to extract certs
from all tokens, regardless of their friendly/non-friendly status ? Some of the
certs in the tokens might be necessary to complete the chain and verify it, eg.
the roots. Of course, our root cert module is friendly, so that's not an issue.
But if you had the root, say, in an HSM, perhaps the authentication would be
required.

The alternative would be to try to do the verification without auth, and if it
fails, do the auth and try again. Seems messy, though.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

> seems messy

But That's exactly what the fix for 244907 did.

Comment 5

[Wan-Teh Chang]

Assigned the bug to Bob.  Target NSS 3.10.

Comment 6

[Julien Pierre]

This was fixed in bug 326637 . Marking duplicate.



*** This bug has been marked as a duplicate of 326637 ***