主页 / server / 问题 / 588108
Accepted
Dustin Oprea
Asked: 2014-04-11 06:32:36 +0800 CST

请求/X509 替代名称/扩展信息的完整性

  • 772

假设请求或 X509 证书中的主题和扩展信息都受到保护，我是否正确？

这个签名只是嵌入在 ASN.1 编码中的另一个元素？

openssl

1 个回答

  1. Best Answer

    你是对的。这两个项目的完整性可以通过请求上的数字签名（使用请求者的私钥签名）或证书（由 CA 的私钥签名）来验证。

    编辑：

    RFC 2986，第 3 节描述 PKCS #10 证书请求：

    3. Overview

   A certification request consists of three parts: "certification
   request information," a signature algorithm identifier, and a digital
   signature on the certification request information.

    ...

            1. A CertificationRequestInfo value containing a subject
           distinguished name, a subject public key, and optionally a
           set of attributes is constructed by an entity requesting
           certification.

        2. The CertificationRequestInfo value is signed with the subject
           entity's private key.  (See Section 4.2.)

    第 5 页：

    The components of type CertificationRequestInfo have the following
   meanings:

    ...

     attributes is a collection of attributes providing additional
          information about the subject of the certificate.  Some
          attribute types that might be useful here are defined in PKCS
          ...
          certificate revocation.  Another example is information to
          appear in X.509 certificate extensions (e.g. the
          extensionRequest attribute from PKCS #9).  The values of type

    RFC 5280 re：x.509 证书：

    4.1.1.3.  signatureValue

   The signatureValue field contains a digital signature computed upon
   the ASN.1 DER encoded tbsCertificate.  The ASN.1 DER encoded
   tbsCertificate is used as the input to the signature function.
   ...


4.1.2.  TBSCertificate

   The sequence TBSCertificate contains information associated with the
   subject of the certificate and the CA that issued it.  Every
   TBSCertificate contains the names of the subject and issuer, a public
   key associated with the subject, a validity period, a version number,
   and a serial number; some MAY contain optional unique identifier
   fields.  The remainder of this section describes the syntax and
   semantics of these fields.  A TBSCertificate usually includes
   extensions.
    • 2

相关问题