saymrwulf/cryptography
1
0
Fork 0
mirror of https://github.com/saymrwulf/cryptography.git synced 2026-05-14 20:37:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Relax root CA AKI field checks (#11462)

Browse source 
* Relax root CA AKI field checks

Closes #11461.

Signed-off-by: William Woodruff <william@yossarian.net>

* CHANGELOG: record changes

Signed-off-by: William Woodruff <william@yossarian.net>

---------

Signed-off-by: William Woodruff <william@yossarian.net>
This commit is contained in:
William Woodruff 2024-08-20 11:42:56 -04:00 committed by GitHub
parent 932b8a3f67
commit 4a2d9969aa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 16 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
CHANGELOG.rst
View file

@ -12,6 +12,9 @@ Changelog
not be empty.
* Added support for timestamp extraction to the
:class:`~cryptography.fernet.MultiFernet` class.
* Relax the Authority Key Identifier requirements on root CA certificates
during X.509 verification to allow fields permitted by :rfc:`5280` but
forbidden by the CA/Browser BRs.
.. _v43-0-0:

19
src/rust/cryptography-x509-verification/src/policy/extension.rs
View file

@ -412,18 +412,13 @@ pub(crate) mod ca {
));
}
// authorityCertIssuer and authorityCertSerialNumber MUST NOT be present.
if aki.authority_cert_issuer.is_some() {
return Err(ValidationError::Other(
"authorityKeyIdentifier must not contain authorityCertIssuer".to_string(),
));
}
if aki.authority_cert_serial_number.is_some() {
return Err(ValidationError::Other(
"authorityKeyIdentifier must not contain authorityCertSerialNumber".to_string(),
));
}
// NOTE: CABF 7.1.2.1.3 says that Root CAs MUST NOT
// have authorityCertIdentifier or authorityCertSerialNumber,
// but these are present in practice in trust program bundles
// due to older roots that have been grandfathered in.
// Other validators are permissive of these being present,
// so we don't check for them.
// See #11461 for more information.
}
Ok(())

6
tests/x509/verification/test_limbo.py
View file

@ -67,6 +67,12 @@ LIMBO_SKIP_TESTCASES = {
# forbidden under CABF. This is consistent with what
# Go's crypto/x509 and Rust's webpki crate do.
"webpki::aki::root-with-aki-ski-mismatch",
# We allow root CAs where the AKI contains fields other than keyIdentifier,
# which is technically forbidden under CABF. No other implementations
# enforce this requirement.
"webpki::aki::root-with-aki-authoritycertissuer",
"webpki::aki::root-with-aki-authoritycertserialnumber",
"webpki::aki::root-with-aki-all-fields",
# We allow RSA keys that aren't divisible by 8, which is technically
# forbidden under CABF. No other implementation checks this either.
"webpki::forbidden-rsa-not-divisable-by-8-in-root",