Revisiting the X.509 Certification Path Validation RuhrSec 2018, - - PowerPoint PPT Presentation

▶
revisiting the x 509 certification path validation
SMART_READER_LITE
LIVE PREVIEW

Revisiting the X.509 Certification Path Validation RuhrSec 2018, - - PowerPoint PPT Presentation

Dec 01, 2023 276 likes •828 views

Revisiting the X.509 Certification Path Validation RuhrSec 2018, Bochum Dr. Falko Strenzke cryptosource GmbH, Darmstadt fstrenzke@cryptosource.de cryptosource Cryptography. Security. June 6, 2018 cryptosource X.509 Path Validation Falko

slide-1
SLIDE 1

Revisiting the X.509 Certification Path Validation

RuhrSec 2018, Bochum

  • Dr. Falko Strenzke

cryptosource GmbH, Darmstadt fstrenzke@cryptosource.de

cryptosource

  • Cryptography. Security.

June 6, 2018

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

1 / 53

slide-2
SLIDE 2

X.509 Certification Path Validation

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

2 / 53

slide-3
SLIDE 3

BSI Project on the Certification Path Validation

X.509 certification path validation subject to many historical implementation errors creation of

a test tool a test specification

application to 10 test subjects

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

3 / 53

slide-4
SLIDE 4

Joint Work

Armin Cordel Heike Hagemeier BSI BSI Evangelos Karatsiolis Falko Strenzke MTG AG cryptosource GmbH

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

4 / 53

slide-5
SLIDE 5

X.509 Certificates

serial number subject name= A issuer name subject public key validity period

  • cert. extensions

signature serial number subject name=xy.de issuer name = A subject public key validity period

  • cert. extensions

signature private key generate signature verify signature X.509-Cert. TBS Data

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

5 / 53

slide-6
SLIDE 6

X.509 Certificate build-up

X.509 Certificate: ASN.1/DER encoding (TLV) TBS-Data

Version (v1,v2,v3) Serial number Signature algorithm Issuer (Issuer DN) Owner (Subject DN) notBefore (creation date) notAfter (expiration date) Public key Extensions (critical/non-critical(*)), e.g.

Basic Constraints (CA certificate yes/no) Key Usage Pointers to revocation information

Signature (*)Extension marked as critical: extension must be processed or

  • cert. rejected

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

6 / 53

slide-7
SLIDE 7

Internet PKI

root CA 1 sub CA 1 sub CA 2 root CA 1 CRL server 2 server 1 root CA 0

trusted

sub CA 0 server 0 sub CA 1 CRL server 3 server 4 sub CA 2 CRL

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

7 / 53

slide-8
SLIDE 8

Certificate Chains

serial number = 1 subject name= super root issuer name = super root subject public key validity period

  • cert. extensions

Trust Anchor signature serial number = 1 subject name= subCA 1 issuer name = super root subject public key validity period

  • cert. extensions:

Basic Constr.: isCA=true intermediate CA serial number = 23247293 subject name= xy.de issuer name = subCa 1 subject public key validity period

  • cert. extensions:
  • ext. ABC (Crit)

target (end-entity) cert. signature signature verify signature verify signature verify signature historical vulnerabilities:

  • accept any self-signed as trusted
  • failure to validate TLS hostname
  • accept target cert. as CA
  • ignoring unknown critical extensions

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

8 / 53

slide-9
SLIDE 9

Historical Vulnerabilities in X.509 Validation

Further historical Vulnerabilities in the X.509 Certificate Validation Null-Prefix Attack

certificate authority (CA) has to validate applicant’s ownership

  • f the domain

apply for certificate xy.de\0abc.com path validation

routines see \0 as byte with value 0 in C language this is the string terminator and thus the certificate is considered valid for xy.de

Cryptography related vulnerabilities

Bleichenbacher’s low exponent attack: invalid parsing of “decrypted” RSA signatures empty signatures accepted etc.

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

9 / 53

slide-10
SLIDE 10

Existing Test Tools: Frankencerts

research project 2014 “Frankencerts” idea:

use the internet as a source for a diversity of X.509 certificates use an algorithm to create mutants (combinations of parts) of this corpus use differential testing to find deviating results for the same certificate chain differential testing: input the same test data into multiple test subjects and observe if any behaves differently

Pros:

no modelling of the test data or the validation algorithm necessary identifies a large number of (subtle) errors

Cons:

requires manual analysis when test results deviate generation of test data satisfying application specific requirements is not straight forward

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

10 / 53

slide-11
SLIDE 11

Existing Test Tools: NIST’s PKITS Test Suite

PKITS Test Suite (NIST)

Large number of static test cases Users must organise data themselves De-facto standard for libraries Pros:

High test coverage especially for extensions

Cons: static test data

CommonName / SAN Signature algorithms

cannot be varied

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

11 / 53

slide-12
SLIDE 12

New Test Specification and Tool

Test Specification

Test suite with covering the most important aspects “dynamic parametrization”

e.g. instantiate the same test with different signature algorithms

Test Tool

Certification Path Validation Test Tool (CPT) Open Source (EUPL, Apache 2.0, . . . ) generate the test data from test specification execute the test against TLS, IPsec and S/MIME applications

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

12 / 53

slide-13
SLIDE 13

Test Specification

Systematic derivation of the test specification: Rules from standards (RFC 5280 + Application specific) Historical errors:

CVE Vulnerability database (https://cve.mitre.org/) Search terms (certificate validation, intermediate CA, ...) Publications Errors known to us (NULL character)

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

13 / 53

slide-14
SLIDE 14

Test Specification

76 test cases

General Extensions Revocation Cryptographic aspects Email (S/MIME) IPsec TLS Server TLS Client

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

14 / 53

slide-15
SLIDE 15

Test Data Specification

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

15 / 53

slide-16
SLIDE 16

Test Data Specification

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

16 / 53

slide-17
SLIDE 17

Test Data Specification

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

17 / 53

slide-18
SLIDE 18

Test Data Specification

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

18 / 53

slide-19
SLIDE 19

<CRL id="CERT_PATH_CRL_09_SUB_CA_CRL"> <Location>http://cert_path_host/sub_ca_crl.crl</Location> <VerifiedBy>CERT_PATH_CRL_09_SUB_CA</VerifiedBy> <Version>1</Version> <Signature>1.2.840.113549.1.1.11</Signature> <IssuerDN encoding="UTF8">CN=Test Sub CA, C=DE</IssuerDN> <ThisUpdate>-8D</ThisUpdate> <NextUpdate>-1D</NextUpdate> <Extension oid="2.5.29.35" critical="false" name="AKI" type="pretty"></Extension> <Extension oid="2.5.29.20" critical="false" name="CRL Number" type="pretty">9</Extension> </CRL>

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

18 / 53

slide-20
SLIDE 20

Specification of a Certification Path

<PKIObjects > <Certificate id=" CERT_PATH_CRL_09_ROOT_CA " refid="ROOT CA"

  • verwrite =" false" type ="TA" />

<Certificate id=" CERT_PATH_CRL_09_SUB_CA_1 " refid =" SUB_CA"

  • verwrite =" true">

... </Certificate > <Certificate id=" CERT_PATH_CRL_09_SUB_CA_2 " refid =" SUB_CA"

  • verwrite =" true">

... </Certificate > <Certificate id=" CERT_PATH_CRL_09_EE " refid =" CRL_02_EE"

  • verwrite =" true" type ="TC">

... </Certificate > <CRL id=" CERT_PATH_CRL_09_ROOT_CRL "> ... </CRL > <CRL id=" CERT_PATH_CRL_09_SUB_CA_CRL "> ... </CRL > </PKIObjects >

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

19 / 53

slide-21
SLIDE 21

CPT Processing

testcases mod common test 1.xml test 2.xml mod crl test 3.xml pkiObjects mod common PO test 1.xml PO test 2.xml mod crl PO test 2.xml refid

CPT basis tool

  • utput

test 2 ....TA.crt (trust anchor) ....CA.crt (intermediate CA) ....TC.crt (target cert (EE cert)) crls/ test 3 ... produce

  • utput

test execution tool

test data is valid

  • cert. chain?

Test subject

present cert. chain

  • library test tool
  • tls test tool
  • IPsec test tool

CRL server (HTTP or LDAP) start server load CRL X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

20 / 53

slide-22
SLIDE 22

Additional Test Tools

library test tools

C/C++ command line tool Java command line tool

TLS test tool

TLS test client TLS test server based on the Botan library additionally: Web frontend to test Browsers

IPsec test tool

based on strongSwan IPsec implementation

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

21 / 53

slide-23
SLIDE 23

Test Subjects

Test subjects

Cryptographic Libraries

OpenSSL (C) Botan (C++) mbedTLS (C) Bouncy Castle (Java) OpenJDK (Java)

Applications

Apache (HTTP Server) Firefox (Browser) strongSwan (IPsec) OpenVPN (VPN) KMail (Email Client)

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

22 / 53

slide-24
SLIDE 24

OpenJDK

OpenJDK shows no single error implementation strongly oriented at the formal algorithms from RFC 5280 http://openjdk.java.net/

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

23 / 53

slide-25
SLIDE 25

Compatibility Issues

Description Botan Bouncy Castle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan too restrictive handling of path length E too restrictive handling of path length with self-issued certificates E E E E E performing non-exhaustive path search E E E – – – – – Acceptance of MD5 as sig- nature hash algorithm with default config E E E E E E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

24 / 53

slide-26
SLIDE 26

Compatibility

Description Botan Bouncy Castle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan too restrictive handling of path length E too restrictive handling of path length with self-issued certificates E E E E E performing non-exhaustive path search E E E – – – – – Acceptance of MD5 as sig- nature hash algorithm with default config E E E E E E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

25 / 53

slide-27
SLIDE 27

Errors regarding the Path Length

serial number = 1 subject name= super root issuer name = super root subject public key validity period

  • cert. extensions

Trust Anchor signature serial number = 1 subject name= subCA 1 issuer name = super root subject public key validity period

  • cert. extensions:

Basic Constr.: pathLen=0 isCA = true intermediate CA serial number = 23247293 subject name=xy.de issuer name = subCa 1 faKey subject public key validity period

  • cert. extensions

target (end-entity) cert. signature signature verify signature verify signature verify signature

  • pathLen: max. nb. of subsequent CA certs
  • Botan: nb. of subsequent certs
  • self-issued certs not counted
  • self-issued if issuer=subject
  • 5 test subjects err
  • Mozilla: “deliberate choice”

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

26 / 53

slide-28
SLIDE 28

Compatibility Issues

Description Botan Bouncy Castle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan too restrictive handling of path length E too restrictive handling of path length with self-issued certificates E E E E E performing non-exhaustive path search E E E – – – – – Acceptance of MD5 as sig- nature hash algorithm with default config E E E E E E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

27 / 53

slide-29
SLIDE 29

Compatibility Issues

Description Botan Bouncy Castle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan too restrictive handling of path length E too restrictive handling of path length with self-issued certificates E E E E E performing non-exhaustive path search E E E – – – – – Acceptance of MD5 as sig- nature hash algorithm with default config E E E E E E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

28 / 53

slide-30
SLIDE 30

Certificate Path Validation

Certificate Path Validation

Path Construction (not for TLS, etc.) Validation of Certificate Chain (RFC 5280) Application specific validations

Specific extensions in target certificate E.g. Key Usage for TLS

Revocation Check (RFC 5280)

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

29 / 53

slide-31
SLIDE 31

(Non-) Exhaustive Path Construction

Path Construction Input:

Target certificate Set of trusted certificates Pool of untrusted certificates

Algorithm

Find issuer A to target certificate Find issuer of A ... Until a trusted root is reached

What if no issuer of sub CA can be found?

Exhaustive search:

discard that sub CA again try next candidate

Non-exhaustive search: break, target certificate is invalid

Problem: DOS through wrong untrusted certificate in cache

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

30 / 53

slide-32
SLIDE 32

Issues: Certificates

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance of an invalid certifi- cate version E E E acceptance of intermediate cer- tificate without basic constraints extension E E acceptance

  • f

intermediate certificate without KeyCertSign Key Usage E acceptance of target certificate with Key Usage extension only featuring keyAgreement key us- age E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

31 / 53

slide-33
SLIDE 33

Issues: Certificates

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance of an invalid certifi- cate version E E E acceptance of intermediate cer- tificate without basic constraints extension E E acceptance

  • f

intermediate certificate without KeyCertSign Key Usage E acceptance of target certificate with Key Usage extension only featuring keyAgreement key us- age E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

32 / 53

slide-34
SLIDE 34

Invalid X.509 Certificate Version

X.509 certificates carry a version number current (hightest) version is v3 receiving certificate with v4

must be rejected: processing rules unknown

system deployed now might have a vulnerability once version 4 is defined

compare with the transition from v1 or v2 to v3: v3 introduced certificate extensions assume an application processes a v3 certificate as v1 or v2 and ignores that is has critical extensions → vulnerability

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

33 / 53

slide-35
SLIDE 35

Issues: Certificates

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance of an invalid certifi- cate version E E E acceptance of intermediate cer- tificate without basic con- straints extension E E acceptance

  • f

intermediate certificate without KeyCert- Sign Key Usage E acceptance of target certificate with Key Usage extension only featuring keyAgreement key us- age E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

34 / 53

slide-36
SLIDE 36

Insufficient Criteria for CA Certificate

serial number = 1 subject name= super root issuer name = super root subject public key validity period

  • cert. extensions

Trust Anchor signature serial number = 1 subject name= subCA 1 issuer name = super root subject public key validity period

  • cert. extensions:

Basic Constr.: isCA=true [Key Usage: keyCertSign] intermediate CA serial number = 23247293 subject name=xy.de issuer name = subCa 1 subject public key validity period

  • cert. extensions

End-entity certificate signature signature verify signature verify signature verify signature OpenVPN, Apache: if Basic Constraints present: → isCA is asserted if Basic Constraints is missing: → accepted as CA But: Key Usage with KeyCertSign is required. (deliberate behaviour of older OpenSSL versions)

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

35 / 53

slide-37
SLIDE 37

Issues: Certificates

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance of an invalid certifi- cate version E E E acceptance of intermediate cer- tificate without basic constraints extension E E acceptance

  • f

intermediate certificate without KeyCertSign Key Usage E acceptance of target certificate with Key Usage extension only featuring keyAgreement key us- age E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

36 / 53

slide-38
SLIDE 38

Key Usage for IPsec

IPsec mandates the Key Usages digitalSignature or nonRepudiation in the target certificate strongSwan fails to verify this certificates not authorized for IPsec may be used

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

37 / 53

slide-39
SLIDE 39

X.509 CRLs

X.509 CRL TBS-Data

Version (v2) Signature algorithm Issuer (Issuer DN) thisUpdate (creation date) nextUpdate (expiration date) Revoked certificates

For each revoked certificate:

  • Serial number
  • Revocation date
  • CRL entry extensions (critical/non-critical),

e.g. revocation reason

Extensions (critical/non-critical),

References to distribution locations Revocation reasons covered

Signature

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

38 / 53

slide-40
SLIDE 40

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

39 / 53

slide-41
SLIDE 41

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance of expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

40 / 53

slide-42
SLIDE 42

Acceptance of Expired Certificates

KMail doesn’t report when a signature certificate or intermediate CA has expired the real problem is not using a certificate beyond its validity: an expired certificate may be removed from a CRL the risk is accepting revoked certificates

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

41 / 53

slide-43
SLIDE 43

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

42 / 53

slide-44
SLIDE 44

Ignoring Missing CRLs

Opportunistic revocation check:

carried out if matching CRL for each certificate is input to the verification routine if no CRL for a certificate is input, revocation check is skipped and certificate is accepted mbedTLS: for all certificates in chain strongSwan: only for intermediate CAs

vulnerability

CRLs are downloaded over insecure connection attacker renders CRL invalid (changes issuer name) revoked certificate is valid!

mbedTLS

deliberate choice (API doc) ! no reliable CRL check possible not fixed for now, future version may contain a switch to enforce revocation checking

strongSwan

is a bug, fixed in next release

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

43 / 53

slide-45
SLIDE 45

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

44 / 53

slide-46
SLIDE 46

Accepting Unknown Critical CRL Extensions

a critical extension can alter processing rules unknown critical extension

New standardized extension proprietary (application specific) extension

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

45 / 53

slide-47
SLIDE 47

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance

  • f

not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

46 / 53

slide-48
SLIDE 48

Not yet valid CRL

thisUpdate date of CRL before current time

CRL is not yet valid must have been issued by a system with deviating clock

potential problem

revoked certificate removed from CRL when certificate expires CRL issuer’s system’s clock is ahead CRL issuer may have removed revoked certificates that the verifier still considers not expired → revoked certificate accepted

rather hypothetical problem (check of thisUpdate not mandated by RFC 5280)

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

47 / 53

slide-49
SLIDE 49

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Distri- bution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

48 / 53

slide-50
SLIDE 50

Mismatching CRL-DP and IDP

certificate Distribution Points Ext. <Names> distribution point 1 (HTTP or LDAP URL) distribution point 2 (HTTP or LDAP URL) . . . CRL 1 IDP: dp1 <Names> CRL 2 IDP: dp2 <Names> certificate extension: CRL Distribution Points (CRL-DP) CRL extension: Issuing Distribution Point (IDP) each extension contains a set of names

  • ne name must match in both
  • therwise the CRL may not be used

there may be multiple distribution points providing different CRLs from one issuer

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

49 / 53

slide-51
SLIDE 51

Issues: CRLs

Description Botan BouncyCastle mbedTLS OpenSSL Apache Firefox KMail OpenVPN strongSwan acceptance

  • f

expired certifi- cates E ignoring lack of matching CRL for any cert. E ignoring lack of matching CRL for intermediate cert. E acceptance of unknown critical CRL extensions E E acceptance of not yet valid CRLs E acceptance of mismatching cer- tificate’s CRL-DP and CRL’s IDP E E E usage of CRL from wrong Dis- tribution Point E

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

50 / 53

slide-52
SLIDE 52

Using CRL from Wrong Distribution Point

certificate 1 Distribution Points Ext. certificate 2 Distribution Points Ext. distribution point 1 (HTTP or LDAP URL) distribution point 2 (HTTP or LDAP URL) CRL 1 CRL 2 uses wrong DP KMail caches CRLs after having downloaded them from a distribution point Caches only per CRL issuer, not by CRL DP Thus fails to check whether the verified certificate specifies another distribution point And thus uses potentially invalid CRL Standard (RFC 5280) is not completely exact here

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

51 / 53

slide-53
SLIDE 53

Conclusion

CPT as a new tool

dynamic test data generation generic XML-based specification tools for testing TLS, IPsec and Email (S/MIME) fills a gap left by existing tools

default test suite

derived from standards and previous errors

applying tests to 10 well-known implementations

uncovering some relevant and interesting compatibility issues some minor vulnerabilities in certificate validation a number of more significant CRL-related issues

insights in how implementers of widespread libraries / applications think

concern about compatibility sometimes higher than security

certificate version

some features are considered just irrelevant

self-issued certificates

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

52 / 53

slide-54
SLIDE 54

Thank you for your attention!

https://www.bsi.bund.de/EN/Topics/OtherTopics/ CPT/cpt_node.html https://github.com/MTG-AG/cpt/ https: //github.com/cryptosource-GmbH/cpt-add-test-tools https://github.com/cryptosource-GmbH/ cpt-native-lib-test

X.509 Path Validation Falko Strenzke cryptosource

  • Cryptography. Security.

53 / 53