<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body>
I believe that there are 2 separate question:<br>
1) Is it possible to validate cert *after* signature verification.<br>
The answer is "NO" because the XML DSig standard allows to specify multiple<br>
certs for each key. And application MUST check all the certs in order to
find <br>
one it accepts. Suppose you have 2 different certs in the signed message
and <br>
the first one is "bad" from your point of view and the second one is "good".<br>
In the case when cert validation is done *after* signature verification,
(as you suggest),<br>
the application will pick up the first cert and you cert validation fails.
<br>
Of course, you application may return list of the certs, etc. but this really
complicates<br>
the logic and I am not sure that there no other logic holes. Not mention
that <br>
this is bad from performance/ Denial Of Service attack point of view (I can
send you<br>
a message signed with very big 4096 RSA key in my cert and you application
<br>
will spend a lot of time validating the signature only to find out that cert
is invalid).<br>
<br>
2) Apps need to have access to certs used to verify key.<br>
You are absoluely correct. I am not sure that I want to open xmlSecX509Data
structure but<br>
I promise to think about something.<br>
<br>
Aleksey<br>
<br>
<br>
Moultrie, Ferrell (ISSAtlanta) wrote:<br>
<blockquote type="cite"
cite="mid121184A7DB1F9143BB5E3FACCB5487570663E2@atlmaiexcp02.iss.local">
<pre wrap="">It occurred to me that there's perhaps an easier way than overriding the
validation function -- I can check the results structure after the
validation is complete. The --print-all shows everything I need to
validate the certificate given that I'm controlling the trusted
certificate store, etc. Looking at results->key->x509Data->verified with
X509_get_subject_name() and validating that a proper certificate was
used (and that pResult->key->origin == xmlSecKeyOriginX509) appears
quite fine for my application. The only problem I've run into in
prototyping this solution is that _xmlSecX509Data struct is private to
x509.c. The definition is below:
struct _xmlSecX509Data {
X509 *verified;
STACK_OF(X509) *certs;
STACK_OF(X509_CRL) *crls;
};
Is there another/better way to access the certificate info used to
validate the request? Otherwise, shouldn't this be moved into x509.h so
that callers can access that data using the result structure?
Thanks!
Ferrell
-----Original Message-----
From: Aleksey Sanin [<a class="moz-txt-link-freetext" href="mailto:aleksey@aleksey.com">mailto:aleksey@aleksey.com</a>]
Sent: Thursday, September 05, 2002 12:01 AM
To: Moultrie, Ferrell (ISSAtlanta)
Cc: <a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
Subject: Re: [xmlsec] Key management / certificate management
As you correctly pointed out, the first your problem (limiting allowed
keys sources
to x509 certs only) could be simply solved by setting "allowedOrigins"
member
of the xmlSecKeysMngr structure.
Regarding your other questions about certs validation, I have to note
that the included
in XMLSec implementation of xmlSecKeysMngr interface is called "simple"
:)
You can extend it or completely overwrite yourself :) You idea about
using custom
verifyX509 callback is absolutely correct. Probably there is one more
way (change
the OpenSSL verification callback) but I am not sure that it is better
(for example,
because this affects all x509 operations in your application).
There is no function to load trusted certs from something other than
file or a folder.
Actually, it is a common practice that trusted certs are located in a
protected folder
and you have read-only access to it (see Apache, Mozilla, IE, and other
implementations).
Of course, there are no reasons why you could not load the trusted cert
from memory
or an XML file. You just need to do some copy/paste :)
Aleksey
Moultrie, Ferrell (ISSAtlanta) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi:
I'd like to control what public keys and/or certs are used or usable
for verifying data. In particular, I'd like to require that the public
key be validated by a cert (i.e., that <sig:KeyValue> supplied
unvalidated keys not be usable,and, I'd like to impose certain
contraints on any cert used (e.g., validating Issuer, Subject, Usage,
etc.). While I could search for a KeyValue node before calling
validation, it seems like there may be a better way to accomplish this
(below). Additionally, it looks like I could store a new verifyX509
(xmlSecX509VerifyCallback) pointer in the xmlSecKeysMngr struct and
intercept the cert verification. Still, since I'm very new to all of
this, I'm wondering if there's not simpler/better/more direct ways to
accomplish these types of checks. Any suggestions or pointers would be
greatly appreciated!
It looks like setting the allowedOrigins flag of the xmlSecKeysMngr
structure to xmlSecKeyOriginX509 may solve my first problem and ensure
that only keys found in a X509 cert will be usable. Correct?
I don't see any such short-cut for validating the X509 cert contents
other than the verifyX509 override I mentioned earlier. Any other way /
better option?
Finally, it looks like xmlSecSimpleKeysMngrLoadPemCert() method can
</pre>
</blockquote>
<pre wrap=""><!---->be
</pre>
<blockquote type="cite">
<pre wrap="">used to load a trusted root certificate for X509 validation from a
</pre>
</blockquote>
<pre wrap=""><!---->file.
</pre>
<blockquote type="cite">
<pre wrap="">I'd rather not have a seperate file storing this information. Is there
any way to load a trusted cert from a memory blob or perhaps from a
second XML document/tree?
Thanks!
Ferrell
_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
<pre wrap=""><!---->
_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
<br>
</body>
</html>