Trouble Validating RSA2048 cert signed by ECDSA CA

[obelisk]

Just tried to do this, OpenSSL verifies fine but the library balks. Using RSA for both the CA and Leaf cert works fine.

[chifflier]

Hi,
I ran several tests, and could reproduce part of the problem, depending of the elliptic curve used to sign the certificate, and the size of the hash.

• currently, only NIST P-256 and P-384 are supported, with hashes of the same size (SHA256 and SHA384)
• NIST P-521 is not supported (ring does not implement it yet, see NIST curve P-521 SHA-512 support for generating keys and signing briansmith/ring#824). I also tried other crates like signatory, but it does not implement it either.

Can you check the curve used by the CA certificate ?

[obelisk]

I believe these two certs reproduce the issue
Certs.zip

[chifflier]

Thank you for providing test data.

I confirm the authority is using NIST P-521, as shown by the following command:

$ openssl x509 -text -noout -in RTCA.pem  | grep -E '(CURVE|OID)'
                ASN1 OID: secp521r1
                NIST CURVE: P-521

So, biggest part of the problem is that NIST P-521is currently not well supported in common Rust crates like ring or ecdsa.

I will look more at possible solutions, but it seems that currently the only option is to use the openssl crate, which would require some rewriting in the current code. I'll have a look.

[obelisk]

I totally missed that it was a 521 cert, I suppose I chose the wrong settings when creating it. I know that ring doesn't support it for whatever reason. Sorry for the noise 🍻

[chifflier]

Well, that was not noise, because I know have a working implementation based on openssl, and I'm currently considering to switch from ring, or eventually to keep both implementations (and use features to allow only one).

I'd prefer to use a Rust solution if possible, but it seems ring aims at correct crypto use (even if that means having only a few algorithms). x509-parser is different, because the objective is to support existing certificates, even if they use weak crypto.

I'll reopen an issue to discuss the switch to openssl.
Thanks!