Subject: [CGA-EXT] [SEND] BUG in RFC 3971 : parsing of RSA Signature Option

From: [email-masked] (Arnaud Ebalard)
Date: Thu, 27 Mar 2008 11:33:44 +0100

Hi,

While implementing SEND for testing purposes, I found what seems to be a
bug in section 5.2 of RFC 3971 with regard to the format of RSA
Signature Option, which prevents unambiguous parsing of the Digital
Signature field.  

This option includes a single length field and two variable length
fields: 

- the Digital Signature field.
- the Padding field.

In the description of those two fields (quoted from the RFC):

- "length of the Digital Signature field is determined by the length of
  the RSA Signature option minus the length of the other fields
  (including the variable length Pad field)
- "This variable-length field [Padding] contains padding, as many bytes
  long as remain after the end of the signature"

Even if it might be possible to *deduce* the length of Digital Signature
field from the length of the key modulus (if you have the key
associated with the hash), this is not the way it should be done (and
does not match previous description). 

Considering the format of previous option in the reference document (CGA
Option - section 5.1), I think 8 bits of the 16 bits Reserved field
should have been used for a padlen field providing the length of Padding
field in RSA Signature Option.

Note that the field was present in draft versions of RFC 3971: it
disappeared in 06. ML archive being unavailable, I cannot check the
reason, if any.

If I am missing something obvious, don't hesitate to correct me ...

Cheers,

a+
_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext