encoding/asn1: ObjectIdentifier + crypto/x509.ParseCertificate does not support int > 28 bits #19933
Labels
FrozenDueToAge
NeedsDecision
Feedback is required from experts, contributors, and/or the community before a change can be made.
Milestone
What version of Go are you using (
go version
)?go version go1.7.5 linux/amd64
(should be the same in go 1.8+)What operating system and processor architecture are you using (
go env
)?What did you do?
Minimum reproducer: https://play.golang.org/p/wITjVuO0-F
The following test cert can also reproduce the problem: https://www.viathinksoft.de/~daniel-marschall/asn.1/oid-sizecheck/oid_size_test.pem
What did you expect to see?
No cert parsing errors.
What did you see instead?
2009/11/10 23:00:00 failed to parse cert: asn1: structure error: base 128 integer too large
The fundamental issue is that
asn1.ObjectIdentifier
is a alias for[]int
instead of[]big.Int
. Based on the data http://luca.ntop.org/Teaching/Appunti/asn1.htmland https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
it would seem that
[]int
is not the correct type.However, since the type is a simple alias, it is trivial to cast between them. Any change to the underlying type would then be considered backwards incompatible. I will leave it to the Go team to decide if that is the case.
We have run into a real world case where an individual was assigned an OID component that requires 29 bits to represent. Thus at this time they cannot use their certs as the current go implementation https://github.com/golang/go/blob/master/src/encoding/asn1/asn1.go#L298 is limited to 28 bits. It should be possible to use 31+ bits from
int
. This would be fully backwards compatible and consistent on all machines. Using a temporaryint64
, one should be able to store greater values on machines whereint
is larger than 32 bits. This would not be consistent across machine architectures.Both of these methods are simple mitigations and would not help in cases such as distribution/distribution#1370 where http://www.oid-info.com/get/2.25 was used to store a 128 bit UUID. They are also not tolerant of implementations that may pad the integer with unnecessary leading zeros.
The text was updated successfully, but these errors were encountered: