663319 - libpkix: Allow caller of CERT_PKIXVerifyCert to specify which signature algorithms are acceptable

Status: NEW

(NSS :: Libraries, enhancement, P5)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

When we call CERT_PKIXVerifyCert, we should be able to specify which signature algorithms (e.g. ECDSA-P256-SHA256, RSA(1024+)-SHA1-PKCS1) are acceptable. Note that, for the NSA Suite B profile for TLS, we need to be able to specify precise combination of algorithm+curve+hash; we can't say "ECDSA or RSA, P256 or P384, SHA256 or SHA384" but instead must say "ECDSA-P256-SHA256 or ECDSA-P384-SHA384". Also, because the safety of RSA signatures depends on the length of the hash being signed, some RSA key lengths need to be restricted to shorter hashes. E.g. RSA1024+SHA512 is not a safe combination but RSA1024+SHA1 and RSA1024+SHA256 are.

Because the rules are likely to be complicated, it might be better to pass in a pointer to a function with the signature (signature algorithm, hash algorithm, public key size, curve ID) -> bool.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Also, passing in a function would allow a caller to specify date-based restrictions (e.g. "no MD5 after July 1, 2011).

Comment 2

[Alexey Chernyak]

Brian, should this bug be open still, or has it been resolved after 9 years?

The function seems to accept a bunch of parameters:

 *  params  - an array of type/value parameters which can be
 *            used to modify the behavior of the validation
 *            algorithm, or supply additional constraints.

https://searchfox.org/mozilla-central/source/security/nss/lib/certhigh/certvfypkix.c#2004

One of which is:

    cert_pi_chainVerifyCallback = 13,
    /* The callback container for doing extra
     * validation on the currently calculated chain.
     * Value is in value.pointer.chainVerifyCallback */

https://searchfox.org/mozilla-central/source/security/nss/lib/certdb/certt.h#901

Don't know if the intent of this bug is satisfied though.

Also don't know if NSS cipher policy applies to cert validations:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Config_Options

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Brian, should this bug be open still, or has it been resolved after 9 years?

IDK, probably neither. If it were me, I'd WONTFIX it.