Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uts-server does not respect digest algorithm #18

Open
gnugnug opened this issue Sep 28, 2021 · 0 comments
Open

uts-server does not respect digest algorithm #18

gnugnug opened this issue Sep 28, 2021 · 0 comments

Comments

@gnugnug
Copy link

gnugnug commented Sep 28, 2021

First of all thank you for wrapping the OpenSSL calls in a webserver interface, very useful!

Problem: Regardless which digest algorithm is specified in the timestamp request, uts-server always applies the same digest algorithm to the timestamp response. Example:
signtool sign /sha1 <CodeSignCert> /fd sha512 /tr http://uts-server /td sha512 file.exe

Expected result: The code signature as well as the timestamp both use SHA512.
Actual behaviour: While the code signature is using SHA512, the timestamp is applied with a SHA256 digest. Changing the /td in the example parameter to any other value has no effect, uts-server always uses SHA256.

It seems that the code to select the digest algorithm is commented out in src/lib/rfc3161.c lin 154+ but I don't know enough about the timestamp query structure on how to extract this value.
Using TS_CONF_set_signer_digest(conf, section, NULL, resp_ctx) I can set the digest algorithm to something else than sha256 via the uts-server configuration file (eg signer_digest = sha512), but then the algorithm is just hardcoded to something else and still not picked up from the request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant