<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 18 nov. 2016 à 14:56, Gervase Markham <<a href="mailto:gerv@mozilla.org" class="">gerv@mozilla.org</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">On 17/11/16 18:41, Erwann Abalea wrote:<br class="">
<blockquote type="cite" class="">Another valid chain:<br class="">
RootCA (subject: "C=UT, O=PerfectCA, CN=Root")<br class="">
-> OnlineCA (subject: "C=UT, O=PerfectCA, CN=Online", pathLen=0)<br class="">
-> OnlineCA (subject: "C=UT, O=PerfectCA, CN=Online", pathLen=0) <= this is the self-issued cert, same name<br class="">
-> EE<br class="">
<br class="">
Having a pathLen=0 doesn’t forbid you from creating a CA<br class="">
certificate, it only forbids you from creating a CA certificate<br class="">
for a different CA. This is defined in X.509 and repeated in RFC5280.<br class="">
This behaviour is supported by OpenSSL, probably by Microsoft<br class="">
(haven’t checked), I guess by Mozilla libPKIX but not Mozilla::pkix<br class="">
(just quickly read the source).<br class="">
</blockquote>
<br class="">
Well, %$£&*.<br class="">
<br class="">
So an attacker can effectively leverage a SHA-1 collision into a cert<br class="">
which is equivalent to the issuing intermediate but for which they<br class="">
control the private key?<br class="">
</div>
</blockquote>
</div>
<br class="">
<div class="">Yes.</div>
<div class=""><br class="">
</div>
<div class="">RFC5280 section 4.2.1.9 Basic Constraints:</div>
<div class="">
<div class="">…</div>
<div class=""> The pathLenConstraint field is meaningful only if the cA boolean is</div>
<div class=""> asserted and the key usage extension, if present, asserts the</div>
<div class=""> keyCertSign bit (Section 4.2.1.3). In this case, it gives the</div>
<div class=""> maximum number of <b class="">non-self-issued</b> intermediate certificates that may</div>
<div class=""> follow this certificate in a valid certification path.</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">And this is taken into account in section 6.1 presenting the validation algorithm.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
<div class=""><br class="">
</div>
</div>
</div>
</body>
</html>