I have attached their ECC root certificate and CRL, they are both publicly
available so I think I should be okay :) (the fingerprint can be verified
at: https://mobiletrust.certicom.com/mobiletrust/root.html)
As for which fields they are using I am unsure (however I would guess since
they hold the patents in reference its probably the 2^m fields, below you
will see the asn1parse output of the certificate:
0:d=0 hl=3 l= 245 cons: SEQUENCE
3:d=1 hl=3 l= 178 cons: SEQUENCE
6:d=2 hl=2 l= 3 cons: cont [ 0 ]
8:d=3 hl=2 l= 1 prim: INTEGER :02
11:d=2 hl=2 l= 1 prim: INTEGER :01
14:d=2 hl=2 l= 11 cons: SEQUENCE
16:d=3 hl=2 l= 7 prim: OBJECT :ecdsa-with-SHA1
25:d=3 hl=2 l= 0 prim: NULL
27:d=2 hl=2 l= 21 cons: SEQUENCE
29:d=3 hl=2 l= 19 cons: SET
31:d=4 hl=2 l= 17 cons: SEQUENCE
33:d=5 hl=2 l= 3 prim: OBJECT :commonName
38:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Certicom A
50:d=2 hl=2 l= 30 cons: SEQUENCE
52:d=3 hl=2 l= 13 prim: UTCTIME :000922040000Z
67:d=3 hl=2 l= 13 prim: UTCTIME :200922040000Z
82:d=2 hl=2 l= 21 cons: SEQUENCE
84:d=3 hl=2 l= 19 cons: SET
86:d=4 hl=2 l= 17 cons: SEQUENCE
88:d=5 hl=2 l= 3 prim: OBJECT :commonName
93:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Certicom A
105:d=2 hl=2 l= 43 cons: SEQUENCE
107:d=3 hl=2 l= 16 cons: SEQUENCE
109:d=4 hl=2 l= 7 prim: OBJECT :id-ecPublicKey
118:d=4 hl=2 l= 5 prim: OBJECT :1.3.132.0.1
125:d=3 hl=2 l= 23 prim: BIT STRING
150:d=2 hl=2 l= 32 cons: cont [ 3 ]
152:d=3 hl=2 l= 30 cons: SEQUENCE
154:d=4 hl=2 l= 11 cons: SEQUENCE
156:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage
161:d=5 hl=2 l= 4 prim: OCTET STRING
167:d=4 hl=2 l= 15 cons: SEQUENCE
169:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
174:d=5 hl=2 l= 1 prim: BOOLEAN :255
177:d=5 hl=2 l= 5 prim: OCTET STRING
184:d=1 hl=2 l= 11 cons: SEQUENCE
186:d=2 hl=2 l= 7 prim: OBJECT :ecdsa-with-SHA1
195:d=2 hl=2 l= 0 prim: NULL
197:d=1 hl=2 l= 49 prim: BIT STRING
I understand that new algorithms are not easily "plugged" openssl, but I was
hopping some one had already grafted it :)
Ryan
-----Original Message-----
From: Dr S N Henson [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 27, 2001 11:28 AM
To: [EMAIL PROTECTED]
Subject: Re: ECDSAwithSHA1 support in OpenSSL
Ryan Hurst wrote:
>
> Has any work been done to add ECDSAwithSHA1 (1.2.840.10045.4.1) to
OpenSSL?
> I see that the appropriate NIDs have been added in but I am assuming this
is
> simply a result of their inclusion in
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-ipki-pkalgs-03.txt.
>
> I am interested in using OpenSSL to verify the Certicom ECC root, I am
aware
> of the patent issues involved in ECC but am curious if there are
appropriate
> patches available to OpenSSL to support ECC natively or with a patch that
> would utilize the Certicom Security Builder SDK.
>
What field does the Certicom ECC root use, is it available anywhere?
There's currenttly no ECDSA support in OpenSSL but some EC operations
are in the latest development version, however they only work on prime
fields not 2^m fields. 2^m fields tend to have more patents associated
with them.
It isn't currenly possible to just plug in a new public key crypto
algorithm into OpenSSL and it would in any case need ASN1 support with
the EC public key format. This would require quite a bit of modification
to OpenSSLs core code.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
certicoma.crl
certicoma.crt
