Maniphest T8222

Show RSA-PSS certificates as de-vs compliant in X.509 key listings
Testing, NormalPublic
Actions

Assigned To
None
Authored By
• werner
Tue, Apr 14, 5:18 PM
Tags
Subscribers
timegrid
• werner

Description

gpgsm's key listing (using colon mode) does not flag PSS certificates as de-vs compliant despite that verification of data shows thathe signature was compliant.

Revisions and Commits

rG GnuPG
rGf5807f41ad8c gpgsm: Show rsaPSS certificates as de-vs compliant in listings.
rG639f7f18fc65 gpgsm: Show rsaPSS certificates as de-vs compliant in listings.

Related Objects

Event Timeline

• werner triaged this task as Normal priority.Tue, Apr 14, 5:18 PM
• werner created this task.
• werner moved this task from Backlog to WIP on the gnupg26 board.
• werner added a commit: rG639f7f18fc65: gpgsm: Show rsaPSS certificates as de-vs compliant in listings..Tue, Apr 14, 5:25 PM
• werner added a commit: rGf5807f41ad8c: gpgsm: Show rsaPSS certificates as de-vs compliant in listings..Wed, Apr 15, 1:23 PM
• werner changed the task status from Open to Testing.Wed, Apr 15, 2:44 PM
• werner moved this task from Backlog to QA on the gnupg22 board.
timegrid added a subscriber: timegrid.Thu, Apr 16, 11:56 AM

Looks good to me on vsd-3.3.7-beta90.9 @ win10.

Given the certificates:

ca.pem2 KBDownload

edward.tester-all.pem7 KBDownload

Output of gpgsm

> gpgsm -k --with-colons
crt::4096:1:E004BFBAC0BEFCD0:20260416T093134:20270416T093134:09::1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE::esES::::::23:
[...]
crt:u:4096:1:05820209F8375194:20260416T093115:20480410T093115:1494A4F8F628848EC270D23EE981CBE126C4ED9C::1.2.840.113549.1.9.1=#636140676E7570672E74657374,CN=CA,OU=QA,O=g10code,L=Erkrath,ST=NRW,C=DE::cC::::::23:
[...]

Display in Kleopatra:

Certificates Details:

ca

% openssl x509 -noout -text -in smime_certs/ca.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:94:a4:f8:f6:28:84:8e:c2:70:d2:3e:e9:81:cb:e1:26:c4:ed:9c
        Signature Algorithm: rsassaPss
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)
[...]
    Signature Algorithm: rsassaPss
    Signature Value:
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)

edward.tester-all

% openssl x509 -noout -text -in smime_certs/edward.tester-all.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9 (0x9)
        Signature Algorithm: rsassaPss
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)
[...]
    Signature Algorithm: rsassaPss
    Signature Value:
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)
• ebo edited projects, added gnupg22 (gnupg-2.2.54); removed gnupg22.Thu, Apr 16, 12:39 PM
• werner mentioned this in T7998: Release GnuPG 2.5.19.Fri, Apr 24, 1:21 PM