I have a strange problem verifying one particular OCSP response.
openssl ocsp -respin test.resp -VAfile myresponder.cer
fails with
32473:error:04077077:rsa routines:RSA_verify:wrong signature length:rsa_sign.c:154:
32473:error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib:a_verify.c:162:
32473:error:27069075:OCSP routines:OCSP_basic_verify:signature failure:ocsp_vfy.c:98:
But asn1parse can dump the structure of the response file without any problems. However, I noticed that the signature in this particular response is one byte shorter than in the other responses.
Then I did some tracing in the openssl-0.9.7b code and found out that in the OCSP_BASICRESP structure the signature->length is 127 but RSA_size(signature->data) returns 128 which leads to the error condition.
And now the funny part: when forcing signature->length=128 in crypto/asn1/a_verify.c:160 I could successfully verify the signature no matter what is in the 128th byte of signature->data!
Unfortunately I haven't been able to track down the place where the signature->length field is calculated for the OCSP_BASICRESP structure, but at the moment I suspect a bug somewhere there.
Has anyone seen something similar or can help me with this?
TIA,
tanel
PS. The responder that generated this buggy? response is based on openssl as well
______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
