Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-9705

Invalid storage of SIM value (RFC4683) in the Subject Alternative Name of a certificate

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 7.4.3.2
    • Component/s: None
    • Labels:
      None
    • Issue discovered during:
      Customer
    • Sprint:
      EJBCA Team Alice - 2020 w50

      Description

      The customer mentiond to the attached code (Image.png) and explain that inside the SIM, EJBCA is storing the hash of the authorityRandomSource (i.e.: authorityRandom), however during the PEPSI generation, the authorityRandomSource itself is being used.

      they refer to:

      4.3. Random Number Generation

      The RA generates a random number, R. A new R MUST be generated for
      each SIM. The length of R MUST be the same as the length of the
      output of the hash algorithm H. For example, if H is SHA-1, the
      random number MUST be 160 bits.

      based on this, the length of R must be the same as the length of the output of the hash algorithm H, but it seems like the length of the authorityRandomSource is always 16 bytes regardless of the hashing algorithm?

      They want to validate the PEPSI or SIM value without knowing the real value of the authorityRandomSource?

        Attachments

        1. image.png
          image.png
          106 kB
        2. RFC4683Tools.java
          16 kB
        3. RFC4683ToolsTest.java
          12 kB

          Issue Links

            Activity

              People

              Assignee:
              tomas Tomas Gustavsson
              Reporter:
              younesj Younes Javan Chari
              Verified by:
              Henrik Sunmark
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 3 hours
                  3h