[xmlsec] question: *X509VerifyAndExtractKey

Tejkumar Arora tej at netscape.com
Wed May 28 18:07:34 PDT 2003

Tejkumar Arora wrote:

 > Hi Aleksey,
 > After you read in <X509Data>, you invoke *X509VerifyAndExtractKey to
 > identify a valid cert that contains the key to be used.
 > In *X509VerifyAndExtractKey, you invoke
 >          *X509StoreVerify(x509store, certs_from_<X509Data>,
 > crls_from_<X509Data>....)
 > In *X509StoreVerify, the list of certs you search is
 >           certs_from_<X509Data> + untrusted certs from x509store.

A related question: Are you accounting for multiple <X509Data>
elements under <KeyInfo> ?.

I see in the logic that you call *X509VerifyAndExtractKey
immediately after reading one <X509Data> element.....


 > The issue is: why do you add "untrusted certs from x509store.".
 > I think I know why, but wanted to hear it from you.
 > The spec is a bit ambiguous about whether the certs_from_<X509Data>
 > contains the public key to be used.
 > 1. "All certificates appearing in an X509Data element MUST relate
 > to the  validation key by either containing it or being part
 > of a certification chain that   terminates in a  certificate containing
 > the validation key."
 > This implies that the key may not be in certs_from_<X509Data>
 > 2.  "Whenever multiple certificates occur in an X509Data element, at
 > least one such certificate must contain the public key which verifies
 > the signature. "
 > This implies that the key MUST be in certs_from_<X509Data>.
 > My feeling is that (2) is talking about all <X509Data> elements
 > under keyinfo, not just one.
 > thanks,
 > -Tej

More information about the xmlsec mailing list