☰

请求/X509 备用名称/扩展信息的完整性

tag-icon • tag-icon openssl x509
请求/X509 备用名称/扩展信息的完整性

我是否正确地假设存在针对请求或 X509 证书中的主题和扩展信息的修改的保护？

这个签名只是嵌入在 ASN.1 编码中的另一个元素吗？

答案1

您说得对。这两项的完整性都可以通过请求上的数字签名（使用请求者的私钥签名）或证书（使用 CA 的私钥签名）来验证。

编辑：

RFC 2986 第 3 节描述了 PKCS #10 证书请求：

3. Overview

   A certification request consists of three parts: "certification
   request information," a signature algorithm identifier, and a digital
   signature on the certification request information.

...

        1. A CertificationRequestInfo value containing a subject
           distinguished name, a subject public key, and optionally a
           set of attributes is constructed by an entity requesting
           certification.

        2. The CertificationRequestInfo value is signed with the subject
           entity's private key.  (See Section 4.2.)

和第 5 页：

The components of type CertificationRequestInfo have the following
   meanings:

...

 attributes is a collection of attributes providing additional
          information about the subject of the certificate.  Some
          attribute types that might be useful here are defined in PKCS
          ...
          certificate revocation.  Another example is information to
          appear in X.509 certificate extensions (e.g. the
          extensionRequest attribute from PKCS #9).  The values of type

RFC 5280 回复：x.509 证书：

4.1.1.3.  signatureValue

   The signatureValue field contains a digital signature computed upon
   the ASN.1 DER encoded tbsCertificate.  The ASN.1 DER encoded
   tbsCertificate is used as the input to the signature function.
   ...


4.1.2.  TBSCertificate

   The sequence TBSCertificate contains information associated with the
   subject of the certificate and the CA that issued it.  Every
   TBSCertificate contains the names of the subject and issuer, a public
   key associated with the subject, a validity period, a version number,
   and a serial number; some MAY contain optional unique identifier
   fields.  The remainder of this section describes the syntax and
   semantics of these fields.  A TBSCertificate usually includes
   extensions.

相关内容