Peer supported certificate signature algorithms are not being checked with default SunX509 key manager

XMLWordPrintable

    • Type: Bug
    • Resolution: Duplicate
    • Priority: P4
    • 26
    • Affects Version/s: 24
    • Component/s: security-libs
    • None

      When the deafult SunX509KeyManagerImpl is being used we are in violation of TLSv1.3 RFC spec because we ignore peer supported certificate signatures sent to us in "signature_algorithms"/"signature_algorithms_cert" extensions:
      https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2.2
      https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2.3

      X509KeyManagerImpl on the other hand includes the algorithms sent by the peer in "signature_algorithms_cert" extension (or in "signature_algorithms" extension when "signature_algorithms_cert" extension isn't present) in the algorithm constraints being checked.

            Assignee:
            Artur Barashev
            Reporter:
            Artur Barashev
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: