New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 1 user
Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Aug 2009
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Feature

Restricted
  • Only users with Commit permission may comment.



Sign in to add a comment
Security: Treat certificate signatures using weak signature algorithms as invalid
Project Member Reported by wtc@chromium.org, Aug 7 2009 Back to list
Before we get the Windows update that changes CryptoAPI to disallow
the use of MD2 and MD4 in certificate signatures, we can add code to
treat those certificate signatures as invalid.

Sites with an MD2 or MD4 signature (specifically, md2WithRSAEncryption
or md4WithRSAEncryption) in the end-entity certificate or an intermediate
CA certificate in the certificate chain will get the "invalid certificate"
SSL interstitial page, which has only the "Back" button.

Note: the signatures in root CA certificates are irrelevant.
md2WithRSAEncryption and md4WithRSAEncryption are the only MD2/MD4
signature algorithms listed in CryptoAPI's header file <wincrypt.h>.
 
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=22709 

------------------------------------------------------------------------
r22709 | wtc@chromium.org | 2009-08-06 18:09:57 -0700 (Thu, 06 Aug 2009) | 7 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x509_certificate_win.cc?r1=22709&r2=22708

Treat certificate signatures using weak signature algorithms
as invalid.

R=cevans,mal
BUG= http://crbug.com/18725 
TEST=none
Review URL: http://codereview.chromium.org/164115
------------------------------------------------------------------------

Comment 2 by bugdro...@gmail.com, Aug 13 2009
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=23268 

------------------------------------------------------------------------
r23268 | laforge@chromium.org | 2009-08-12 17:19:18 -0700 (Wed, 12 Aug 2009) | 11 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/branches/195/src/net/base/x509_certificate_win.cc?r1=23268&r2=23267

Merge 22709 - Treat certificate signatures using weak signature algorithms
as invalid.

R=cevans,mal
BUG= http://crbug.com/18725 
TEST=none
Review URL: http://codereview.chromium.org/164115

TBR=wtc@chromium.org

Review URL: http://codereview.chromium.org/165426
------------------------------------------------------------------------

Comment 3 by bugdro...@gmail.com, Aug 13 2009
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=23283 

------------------------------------------------------------------------
r23283 | mal@chromium.org | 2009-08-12 22:23:04 -0700 (Wed, 12 Aug 2009) | 11 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/branches/172/src/net/base/x509_certificate_win.cc?r1=23283&r2=23282

Merge 22709 - Treat certificate signatures using weak signature algorithms
as invalid.

R=cevans,mal
BUG= http://crbug.com/18725 
TEST=none
Review URL: http://codereview.chromium.org/164115

TBR=wtc@chromium.org

Review URL: http://codereview.chromium.org/164460
------------------------------------------------------------------------

Comment 4 by abarth@chromium.org, Aug 15 2009
Labels: -Pri-0 Pri-1
Status: FixUnreleased
@wtc: is there more to do here?  If so, please reopen.
Comment 5 by bugdro...@gmail.com, Aug 17 2009
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=23497 

------------------------------------------------------------------------
r23497 | wtc@chromium.org | 2009-08-14 16:49:19 -0700 (Fri, 14 Aug 2009) | 14 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/app/generated_resources.grd?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/ssl/ssl_error_info.cc?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/ssl/ssl_error_info.h?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/ssl/ssl_policy.cc?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/common/security_filter_peer.cc?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/base/cert_status_flags.cc?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/base/cert_status_flags.h?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/base/net_error_list.h?r1=23497&r2=23496
   M http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x509_certificate_win.cc?r1=23497&r2=23496

Add new certificate error code
ERR_CERT_WEAK_SIGNATURE_ALGORITHM and certificate status
flag CERT_STATUS_WEAK_SIGNATURE_ALGORITHM.  Note that I
didn't add new load flag
LOAD_IGNORE_CERT_WEAK_SIGNATURE_ALGORITHM.

Allow users to accept MD2 certificates as certificates
signed using a weak signature algorithm.  MD4 certificates
are still treated as invalid certificates.

R=jar,jcampan
BUG= http://crbug.com/18725 
TEST=none
Review URL: http://codereview.chromium.org/165504
------------------------------------------------------------------------

Labels: -private
Status: Fixed
Labels: -Area-BrowserBackend Area-Internals
Labels: -Type-Bug Type-Feature
Comment 9 by jsc...@chromium.org, Mar 21 2011
Labels: Review-Security
Project Member Comment 10 by bugdroid1@chromium.org, Oct 13 2012
Labels: Restrict-AddIssueComment-Commit
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Project Member Comment 11 by bugdroid1@chromium.org, Mar 10 2013
Labels: -Area-Internals Cr-Internals
Sign in to add a comment