Skip to content

Commit c808c48

Browse files
emargolisemargolis
authored
Update ValidateCertificateChain() To Allow Certificate Chain Validation without Intermediate Certificate. (#22504)
Using this function to validate CD signing certificates added to the CD Trust Store. Added new unit-test cases.
1 parent faa31fd commit c808c48

7 files changed

+161
-27
lines changed

‎src/credentials/attestation_verifier/DefaultDeviceAttestationVerifier.cpp

+60-3
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ static const ByteSpan kTestPaaRoots[] = {
5555
// used to verify any in-SDK development CDs. The associated keypair to do actual signing is in
5656
// `credentials/test/certification-declaration/Chip-Test-CD-Signing-Key.pem`.
5757
//
58+
// Note that this certificate is a self signed certificate and doesn't chain up to the CSA trusted root.
59+
// This CD Signing certificate can only be used to sign CDs for testing/development purposes
60+
// and should never be used in production devices.
61+
//
5862
// -----BEGIN CERTIFICATE-----
5963
// MIIBszCCAVqgAwIBAgIIRdrzneR6oI8wCgYIKoZIzj0EAwIwKzEpMCcGA1UEAwwg
6064
// TWF0dGVyIFRlc3QgQ0QgU2lnbmluZyBBdXRob3JpdHkwIBcNMjEwNjI4MTQyMzQz
@@ -77,6 +81,50 @@ constexpr uint8_t gTestCdPubkeyBytes[65] = { 0x04, 0x3c, 0x39, 0x89, 0x22, 0x45,
7781
constexpr uint8_t gTestCdPubkeyKid[20] = { 0x62, 0xfa, 0x82, 0x33, 0x59, 0xac, 0xfa, 0xa9, 0x96, 0x3e,
7882
0x1c, 0xfa, 0x14, 0x0a, 0xdd, 0xf5, 0x04, 0xf3, 0x71, 0x60 };
7983

84+
// Official CSA "Matter Certification and Testing CA"
85+
//
86+
// -----BEGIN CERTIFICATE-----
87+
// MIICATCCAaegAwIBAgIHY3Nhcm9vdDAKBggqhkjOPQQDAjBSMQwwCgYDVQQKDAND
88+
// U0ExLDAqBgNVBAMMI01hdHRlciBDZXJ0aWZpY2F0aW9uIGFuZCBUZXN0aW5nIENB
89+
// MRQwEgYKKwYBBAGConwCAQwEQzVBMDAgFw0yMjA3MDcxOTI4MDRaGA8yMTIyMDYx
90+
// MzE5MjgwNFowUjEMMAoGA1UECgwDQ1NBMSwwKgYDVQQDDCNNYXR0ZXIgQ2VydGlm
91+
// aWNhdGlvbiBhbmQgVGVzdGluZyBDQTEUMBIGCisGAQQBgqJ8AgEMBEM1QTAwWTAT
92+
// BgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ4SjrDql2+y3IP5iEdPK1IYm/3EaCkkp+t
93+
// 2GD44nf/wN4fPrYzejSEe1o6BW6ocQ6Td+7t7iUXA/3ZNQEly45Io2YwZDASBgNV
94+
// HRMBAf8ECDAGAQH/AgEBMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUl+Rp0MUE
95+
// FMJvxwH3fpR3OQmN9qUwHwYDVR0jBBgwFoAUl+Rp0MUEFMJvxwH3fpR3OQmN9qUw
96+
// CgYIKoZIzj0EAwIDSAAwRQIgearlB0fCJ49UoJ6xwKPdlPEopCOL9jVCviODEleI
97+
// +mQCIQDvvDCKi7kvj4R4BoFS4BVZGCk4zJ84W4tfTTfu89lRbQ==
98+
// -----END CERTIFICATE-----
99+
//
100+
constexpr uint8_t gCdRootCert[517] = {
101+
0x30, 0x82, 0x02, 0x01, 0x30, 0x82, 0x01, 0xa7, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x07, 0x63, 0x73, 0x61, 0x72, 0x6f, 0x6f,
102+
0x74, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x52, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03,
103+
0x55, 0x04, 0x0a, 0x0c, 0x03, 0x43, 0x53, 0x41, 0x31, 0x2c, 0x30, 0x2a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x23, 0x4d, 0x61,
104+
0x74, 0x74, 0x65, 0x72, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x6e,
105+
0x64, 0x20, 0x54, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x20, 0x43, 0x41, 0x31, 0x14, 0x30, 0x12, 0x06, 0x0a, 0x2b, 0x06, 0x01,
106+
0x04, 0x01, 0x82, 0xa2, 0x7c, 0x02, 0x01, 0x0c, 0x04, 0x43, 0x35, 0x41, 0x30, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x37,
107+
0x30, 0x37, 0x31, 0x39, 0x32, 0x38, 0x30, 0x34, 0x5a, 0x18, 0x0f, 0x32, 0x31, 0x32, 0x32, 0x30, 0x36, 0x31, 0x33, 0x31, 0x39,
108+
0x32, 0x38, 0x30, 0x34, 0x5a, 0x30, 0x52, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x03, 0x43, 0x53, 0x41,
109+
0x31, 0x2c, 0x30, 0x2a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x23, 0x4d, 0x61, 0x74, 0x74, 0x65, 0x72, 0x20, 0x43, 0x65, 0x72,
110+
0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x54, 0x65, 0x73, 0x74, 0x69, 0x6e,
111+
0x67, 0x20, 0x43, 0x41, 0x31, 0x14, 0x30, 0x12, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0xa2, 0x7c, 0x02, 0x01, 0x0c,
112+
0x04, 0x43, 0x35, 0x41, 0x30, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a,
113+
0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x38, 0x4a, 0x3a, 0xc3, 0xaa, 0x5d, 0xbe, 0xcb, 0x72, 0x0f,
114+
0xe6, 0x21, 0x1d, 0x3c, 0xad, 0x48, 0x62, 0x6f, 0xf7, 0x11, 0xa0, 0xa4, 0x92, 0x9f, 0xad, 0xd8, 0x60, 0xf8, 0xe2, 0x77, 0xff,
115+
0xc0, 0xde, 0x1f, 0x3e, 0xb6, 0x33, 0x7a, 0x34, 0x84, 0x7b, 0x5a, 0x3a, 0x05, 0x6e, 0xa8, 0x71, 0x0e, 0x93, 0x77, 0xee, 0xed,
116+
0xee, 0x25, 0x17, 0x03, 0xfd, 0xd9, 0x35, 0x01, 0x25, 0xcb, 0x8e, 0x48, 0xa3, 0x66, 0x30, 0x64, 0x30, 0x12, 0x06, 0x03, 0x55,
117+
0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d,
118+
0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14,
119+
0x97, 0xe4, 0x69, 0xd0, 0xc5, 0x04, 0x14, 0xc2, 0x6f, 0xc7, 0x01, 0xf7, 0x7e, 0x94, 0x77, 0x39, 0x09, 0x8d, 0xf6, 0xa5, 0x30,
120+
0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x97, 0xe4, 0x69, 0xd0, 0xc5, 0x04, 0x14, 0xc2, 0x6f,
121+
0xc7, 0x01, 0xf7, 0x7e, 0x94, 0x77, 0x39, 0x09, 0x8d, 0xf6, 0xa5, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04,
122+
0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x79, 0xaa, 0xe5, 0x07, 0x47, 0xc2, 0x27, 0x8f, 0x54, 0xa0, 0x9e, 0xb1,
123+
0xc0, 0xa3, 0xdd, 0x94, 0xf1, 0x28, 0xa4, 0x23, 0x8b, 0xf6, 0x35, 0x42, 0xbe, 0x23, 0x83, 0x12, 0x57, 0x88, 0xfa, 0x64, 0x02,
124+
0x21, 0x00, 0xef, 0xbc, 0x30, 0x8a, 0x8b, 0xb9, 0x2f, 0x8f, 0x84, 0x78, 0x06, 0x81, 0x52, 0xe0, 0x15, 0x59, 0x18, 0x29, 0x38,
125+
0xcc, 0x9f, 0x38, 0x5b, 0x8b, 0x5f, 0x4d, 0x37, 0xee, 0xf3, 0xd9, 0x51, 0x6d
126+
};
127+
80128
// Official CD "Signing Key 001"
81129
//
82130
// -----BEGIN CERTIFICATE-----
@@ -450,15 +498,24 @@ CHIP_ERROR CsaCdKeysTrustStore::AddTrustedKey(const ByteSpan & kid, const Crypto
450498

451499
CHIP_ERROR CsaCdKeysTrustStore::AddTrustedKey(const ByteSpan & derCertBytes)
452500
{
453-
// TODO: Verify cert against CD root of trust (i.e. verify signatures). To do so,
454-
// we are missing primitives to validate X.509 paths of total length 2.
455-
456501
uint8_t kidBuf[Crypto::kSubjectKeyIdentifierLength] = { 0 };
457502
MutableByteSpan kidSpan{ kidBuf };
458503
P256PublicKey pubKey;
459504

460505
VerifyOrReturnError(CHIP_NO_ERROR == Crypto::ExtractSKIDFromX509Cert(derCertBytes, kidSpan), CHIP_ERROR_INVALID_ARGUMENT);
461506
VerifyOrReturnError(CHIP_NO_ERROR == Crypto::ExtractPubkeyFromX509Cert(derCertBytes, pubKey), CHIP_ERROR_INVALID_ARGUMENT);
507+
508+
if (!IsCdTestKey(kidSpan))
509+
{
510+
// Verify cert against CSA CD root of trust.
511+
CertificateChainValidationResult chainValidationResult;
512+
VerifyOrReturnError(CHIP_NO_ERROR ==
513+
ValidateCertificateChain(gCdRootCert, sizeof(gCdRootCert), nullptr, 0, derCertBytes.data(),
514+
derCertBytes.size(), chainValidationResult),
515+
CHIP_ERROR_INVALID_ARGUMENT);
516+
VerifyOrReturnError(chainValidationResult == CertificateChainValidationResult::kSuccess, CHIP_ERROR_INVALID_ARGUMENT);
517+
}
518+
462519
return AddTrustedKey(kidSpan, pubKey);
463520
}
464521

‎src/credentials/tests/TestCertificationDeclaration.cpp

+64
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,32 @@ static constexpr uint8_t gUntrustedCd[333] = {
181181
0x1e, 0xf5, 0x68, 0x00, 0x23, 0x86, 0xba, 0x39, 0xe7, 0xab, 0x2d, 0xe5, 0x71, 0xe5, 0x36, 0x4e, 0xd0, 0x38,
182182
};
183183

184+
static constexpr uint8_t gUntrustedCdCert[481] = {
185+
0x30, 0x82, 0x01, 0xdd, 0x30, 0x82, 0x01, 0x83, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x14, 0x4e, 0x84, 0xea, 0x0a, 0x68, 0x5b,
186+
0xbe, 0xe2, 0xfb, 0x2d, 0xed, 0x76, 0xaf, 0xa1, 0x92, 0xc4, 0x3a, 0xce, 0x9b, 0x03, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48,
187+
0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x44, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31,
188+
0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x02, 0x43, 0x41, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x0a,
189+
0x0c, 0x04, 0x54, 0x65, 0x73, 0x74, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x10, 0x55, 0x6e, 0x74, 0x72,
190+
0x75, 0x73, 0x65, 0x64, 0x20, 0x43, 0x44, 0x20, 0x63, 0x65, 0x72, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x39, 0x30,
191+
0x36, 0x31, 0x33, 0x34, 0x39, 0x31, 0x35, 0x5a, 0x17, 0x0d, 0x33, 0x32, 0x30, 0x39, 0x30, 0x33, 0x31, 0x33, 0x34, 0x39, 0x31,
192+
0x35, 0x5a, 0x30, 0x44, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0b, 0x30, 0x09,
193+
0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x02, 0x43, 0x41, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x04, 0x54,
194+
0x65, 0x73, 0x74, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x10, 0x55, 0x6e, 0x74, 0x72, 0x75, 0x73, 0x65,
195+
0x64, 0x20, 0x43, 0x44, 0x20, 0x63, 0x65, 0x72, 0x74, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
196+
0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xbc, 0x87, 0x13, 0x3a, 0x19, 0x16,
197+
0x87, 0x04, 0x34, 0x1b, 0x78, 0xc5, 0x70, 0x41, 0x21, 0x14, 0xbb, 0xe5, 0x3f, 0x62, 0x45, 0x70, 0xe8, 0xf2, 0x37, 0x78, 0x77,
198+
0x1a, 0xf3, 0x5c, 0xd8, 0x04, 0x21, 0xc8, 0x2d, 0x40, 0x7f, 0xee, 0x37, 0xf5, 0xa5, 0x9f, 0x17, 0x26, 0x33, 0x00, 0x4d, 0xf7,
199+
0x66, 0xa3, 0x3a, 0x50, 0x75, 0x9f, 0xcf, 0xd2, 0xb2, 0x1b, 0x5e, 0x58, 0x75, 0x08, 0x82, 0x3e, 0xa3, 0x53, 0x30, 0x51, 0x30,
200+
0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x75, 0xe3, 0x06, 0x0e, 0x0f, 0xce, 0x28, 0x69, 0x5d, 0x19, 0x75,
201+
0x43, 0x32, 0xbb, 0xc7, 0x9b, 0xeb, 0x3d, 0x60, 0x6c, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
202+
0x14, 0x75, 0xe3, 0x06, 0x0e, 0x0f, 0xce, 0x28, 0x69, 0x5d, 0x19, 0x75, 0x43, 0x32, 0xbb, 0xc7, 0x9b, 0xeb, 0x3d, 0x60, 0x6c,
203+
0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0a, 0x06, 0x08,
204+
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x21, 0x00, 0x83, 0xdd, 0x0c, 0x66, 0xa2,
205+
0xe3, 0x10, 0x63, 0xa1, 0x17, 0x35, 0x30, 0x13, 0x21, 0xc6, 0x9b, 0x6f, 0x4d, 0x29, 0x94, 0x06, 0xd4, 0xd7, 0xc1, 0x14, 0x01,
206+
0x6d, 0x05, 0x59, 0xbc, 0x40, 0xb2, 0x02, 0x20, 0x76, 0x7f, 0x58, 0x71, 0x12, 0xb4, 0x2e, 0x33, 0x07, 0xed, 0x84, 0x87, 0x06,
207+
0xd4, 0x77, 0xb2, 0xf2, 0xae, 0x65, 0xbd, 0x9d, 0xfe, 0x2f, 0xf8, 0x38, 0xfc, 0x47, 0x45, 0x4f, 0x0c, 0x30, 0xfd
208+
};
209+
184210
static constexpr uint8_t gUntrustedCdVerifyingKeyBytes[65] = { 0x04, 0xbc, 0x87, 0x13, 0x3a, 0x19, 0x16, 0x87, 0x04, 0x34, 0x1b,
185211
0x78, 0xc5, 0x70, 0x41, 0x21, 0x14, 0xbb, 0xe5, 0x3f, 0x62, 0x45,
186212
0x70, 0xe8, 0xf2, 0x37, 0x78, 0x77, 0x1a, 0xf3, 0x5c, 0xd8, 0x04,
@@ -192,6 +218,34 @@ static const P256PublicKey gUntrustedCdVerifyingKey(gUntrustedCdVerifyingKeyByte
192218
static constexpr uint8_t gUntrustedCdKid[20] = { 0x75, 0xE3, 0x06, 0x0E, 0x0F, 0xCE, 0x28, 0x69, 0x5D, 0x19,
193219
0x75, 0x43, 0x32, 0xBB, 0xC7, 0x9B, 0xEB, 0x3D, 0x60, 0x6C };
194220

221+
static constexpr uint8_t gCdSigningCert001[524] = {
222+
0x30, 0x82, 0x02, 0x08, 0x30, 0x82, 0x01, 0xad, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x07, 0x63, 0x73, 0x61, 0x63, 0x64, 0x73,
223+
0x31, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x52, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03,
224+
0x55, 0x04, 0x0a, 0x0c, 0x03, 0x43, 0x53, 0x41, 0x31, 0x2c, 0x30, 0x2a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x23, 0x4d, 0x61,
225+
0x74, 0x74, 0x65, 0x72, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x6e,
226+
0x64, 0x20, 0x54, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x20, 0x43, 0x41, 0x31, 0x14, 0x30, 0x12, 0x06, 0x0a, 0x2b, 0x06, 0x01,
227+
0x04, 0x01, 0x82, 0xa2, 0x7c, 0x02, 0x01, 0x0c, 0x04, 0x43, 0x35, 0x41, 0x30, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x38,
228+
0x31, 0x31, 0x31, 0x39, 0x33, 0x31, 0x31, 0x35, 0x5a, 0x18, 0x0f, 0x32, 0x30, 0x37, 0x32, 0x30, 0x37, 0x32, 0x39, 0x31, 0x39,
229+
0x33, 0x31, 0x31, 0x35, 0x5a, 0x30, 0x58, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x03, 0x43, 0x53, 0x41,
230+
0x31, 0x32, 0x30, 0x30, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x29, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
231+
0x69, 0x6f, 0x6e, 0x20, 0x44, 0x65, 0x63, 0x6c, 0x61, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x69,
232+
0x6e, 0x67, 0x20, 0x4b, 0x65, 0x79, 0x20, 0x30, 0x30, 0x31, 0x31, 0x14, 0x30, 0x12, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
233+
0x82, 0xa2, 0x7c, 0x02, 0x01, 0x0c, 0x04, 0x43, 0x35, 0x41, 0x30, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce,
234+
0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x5b, 0x5b, 0xc3, 0xae,
235+
0xd6, 0xba, 0xa3, 0x83, 0xfd, 0xcf, 0x9b, 0x9d, 0x5a, 0x73, 0xfa, 0xea, 0x7e, 0x65, 0xeb, 0x59, 0x27, 0xc1, 0xc5, 0xc0, 0x2b,
236+
0x1c, 0xfa, 0x4b, 0x8b, 0xdb, 0x6b, 0x9b, 0x7e, 0xb2, 0x52, 0x51, 0x3f, 0x23, 0xf2, 0x2a, 0x58, 0x33, 0x9d, 0xc8, 0xad, 0xb8,
237+
0x80, 0x46, 0x0a, 0xc9, 0x21, 0xd3, 0x76, 0xd7, 0xb9, 0x70, 0xc5, 0x0c, 0x3b, 0xe6, 0xe6, 0xd2, 0x36, 0xf0, 0xa3, 0x66, 0x30,
238+
0x64, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x00,
239+
0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x86, 0x30, 0x1d, 0x06, 0x03, 0x55,
240+
0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x83, 0xfa, 0xd7, 0x81, 0xe8, 0x2d, 0x01, 0x8b, 0x4f, 0x14, 0xf0, 0xa1, 0xc7, 0xf6, 0x84,
241+
0x01, 0x8c, 0xc5, 0xd1, 0x9f, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x97, 0xe4, 0x69,
242+
0xd0, 0xc5, 0x04, 0x14, 0xc2, 0x6f, 0xc7, 0x01, 0xf7, 0x7e, 0x94, 0x77, 0x39, 0x09, 0x8d, 0xf6, 0xa5, 0x30, 0x0a, 0x06, 0x08,
243+
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00, 0x30, 0x46, 0x02, 0x21, 0x00, 0x86, 0xd2, 0xbb, 0xc2, 0xa8,
244+
0x59, 0x38, 0xf9, 0xef, 0xdd, 0x94, 0xc6, 0xd2, 0x7f, 0xb9, 0x28, 0x10, 0x5d, 0x54, 0xcb, 0x45, 0x1b, 0x26, 0xd3, 0xdc, 0xac,
245+
0xda, 0x6d, 0xfb, 0x27, 0x10, 0xef, 0x02, 0x21, 0x00, 0xf1, 0x63, 0x0a, 0x0d, 0xb4, 0x5b, 0xc0, 0xeb, 0x64, 0x69, 0xb2, 0x32,
246+
0xab, 0x00, 0xe0, 0x9a, 0x24, 0x77, 0x2b, 0x09, 0x32, 0x63, 0x06, 0xaa, 0x37, 0x81, 0x8f, 0xb1, 0x12, 0x9f, 0xc7, 0x04
247+
};
248+
195249
struct TestCase
196250
{
197251
ByteSpan signerCert;
@@ -551,6 +605,16 @@ static void TestCD_DefaultCdTrustStore(nlTestSuite * inSuite, void * inContext)
551605

552606
NL_TEST_ASSERT_SUCCESS(inSuite, CMS_Verify(ByteSpan(gUntrustedCd), pubKey, cdContentOut));
553607
}
608+
609+
// Verify that untrusted certificate key cannot be added to the trust store.
610+
{
611+
NL_TEST_ASSERT(inSuite, CHIP_ERROR_INVALID_ARGUMENT == trustStore.AddTrustedKey(ByteSpan(gUntrustedCdCert)));
612+
}
613+
614+
// Verify that trusted certificate key can be added to the trust store.
615+
{
616+
NL_TEST_ASSERT_SUCCESS(inSuite, trustStore.AddTrustedKey(ByteSpan(gCdSigningCert001)));
617+
}
554618
}
555619

556620
#define NL_TEST_DEF_FN(fn) NL_TEST_DEF("Test " #fn, fn)

‎src/crypto/CHIPCryptoPALOpenSSL.cpp

+15-8
Original file line numberDiff line numberDiff line change
@@ -1619,8 +1619,6 @@ CHIP_ERROR ValidateCertificateChain(const uint8_t * rootCertificate, size_t root
16191619

16201620
VerifyOrReturnError(rootCertificate != nullptr && rootCertificateLen != 0 && CanCastTo<long>(rootCertificateLen),
16211621
(result = CertificateChainValidationResult::kRootArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
1622-
VerifyOrReturnError(caCertificate != nullptr && caCertificateLen != 0 && CanCastTo<long>(caCertificateLen),
1623-
(result = CertificateChainValidationResult::kICAArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
16241622
VerifyOrReturnError(leafCertificate != nullptr && leafCertificateLen != 0 && CanCastTo<long>(leafCertificateLen),
16251623
(result = CertificateChainValidationResult::kLeafArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
16261624

@@ -1633,20 +1631,29 @@ CHIP_ERROR ValidateCertificateChain(const uint8_t * rootCertificate, size_t root
16331631
chain = sk_X509_new_null();
16341632
VerifyOrExit(chain != nullptr, (result = CertificateChainValidationResult::kNoMemory, err = CHIP_ERROR_NO_MEMORY));
16351633

1634+
VerifyOrExit(CanCastTo<long>(rootCertificateLen),
1635+
(result = CertificateChainValidationResult::kRootArgumentInvalid, err = CHIP_ERROR_INVALID_ARGUMENT));
16361636
x509RootCertificate = d2i_X509(nullptr, &rootCertificate, static_cast<long>(rootCertificateLen));
16371637
VerifyOrExit(x509RootCertificate != nullptr,
16381638
(result = CertificateChainValidationResult::kRootFormatInvalid, err = CHIP_ERROR_INTERNAL));
16391639

16401640
status = X509_STORE_add_cert(store, x509RootCertificate);
16411641
VerifyOrExit(status == 1, (result = CertificateChainValidationResult::kInternalFrameworkError, err = CHIP_ERROR_INTERNAL));
16421642

1643-
x509CACertificate = d2i_X509(nullptr, &caCertificate, static_cast<long>(caCertificateLen));
1644-
VerifyOrExit(x509CACertificate != nullptr,
1645-
(result = CertificateChainValidationResult::kICAFormatInvalid, err = CHIP_ERROR_INTERNAL));
1646-
1647-
status = static_cast<int>(sk_X509_push(chain, x509CACertificate));
1648-
VerifyOrExit(status == 1, (result = CertificateChainValidationResult::kInternalFrameworkError, err = CHIP_ERROR_INTERNAL));
1643+
if (caCertificate != nullptr && caCertificateLen > 0)
1644+
{
1645+
VerifyOrExit(CanCastTo<long>(caCertificateLen),
1646+
(result = CertificateChainValidationResult::kICAArgumentInvalid, err = CHIP_ERROR_INVALID_ARGUMENT));
1647+
x509CACertificate = d2i_X509(nullptr, &caCertificate, static_cast<long>(caCertificateLen));
1648+
VerifyOrExit(x509CACertificate != nullptr,
1649+
(result = CertificateChainValidationResult::kICAFormatInvalid, err = CHIP_ERROR_INTERNAL));
1650+
1651+
status = static_cast<int>(sk_X509_push(chain, x509CACertificate));
1652+
VerifyOrExit(status == 1, (result = CertificateChainValidationResult::kInternalFrameworkError, err = CHIP_ERROR_INTERNAL));
1653+
}
16491654

1655+
VerifyOrExit(CanCastTo<long>(leafCertificateLen),
1656+
(result = CertificateChainValidationResult::kLeafArgumentInvalid, err = CHIP_ERROR_INVALID_ARGUMENT));
16501657
x509LeafCertificate = d2i_X509(nullptr, &leafCertificate, static_cast<long>(leafCertificateLen));
16511658
VerifyOrExit(x509LeafCertificate != nullptr,
16521659
(result = CertificateChainValidationResult::kLeafFormatInvalid, err = CHIP_ERROR_INTERNAL));

‎src/crypto/CHIPCryptoPALTinyCrypt.cpp

+6-5
Original file line numberDiff line numberDiff line change
@@ -1191,8 +1191,6 @@ CHIP_ERROR ValidateCertificateChain(const uint8_t * rootCertificate, size_t root
11911191

11921192
VerifyOrReturnError(rootCertificate != nullptr && rootCertificateLen != 0,
11931193
(result = CertificateChainValidationResult::kRootArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
1194-
VerifyOrReturnError(caCertificate != nullptr && caCertificateLen != 0,
1195-
(result = CertificateChainValidationResult::kICAArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
11961194
VerifyOrReturnError(leafCertificate != nullptr && leafCertificateLen != 0,
11971195
(result = CertificateChainValidationResult::kLeafArgumentInvalid, CHIP_ERROR_INVALID_ARGUMENT));
11981196

@@ -1203,9 +1201,12 @@ CHIP_ERROR ValidateCertificateChain(const uint8_t * rootCertificate, size_t root
12031201
mbedResult = mbedtls_x509_crt_parse(&certChain, Uint8::to_const_uchar(leafCertificate), leafCertificateLen);
12041202
VerifyOrExit(mbedResult == 0, (result = CertificateChainValidationResult::kLeafFormatInvalid, error = CHIP_ERROR_INTERNAL));
12051203

1206-
/* Add the intermediate to the chain */
1207-
mbedResult = mbedtls_x509_crt_parse(&certChain, Uint8::to_const_uchar(caCertificate), caCertificateLen);
1208-
VerifyOrExit(mbedResult == 0, (result = CertificateChainValidationResult::kICAFormatInvalid, error = CHIP_ERROR_INTERNAL));
1204+
/* Add the intermediate to the chain, if present */
1205+
if (caCertificate != nullptr && caCertificateLen > 0)
1206+
{
1207+
mbedResult = mbedtls_x509_crt_parse(&certChain, Uint8::to_const_uchar(caCertificate), caCertificateLen);
1208+
VerifyOrExit(mbedResult == 0, (result = CertificateChainValidationResult::kICAFormatInvalid, error = CHIP_ERROR_INTERNAL));
1209+
}
12091210

12101211
/* Parse the root cert */
12111212
mbedResult = mbedtls_x509_crt_parse(&rootCert, Uint8::to_const_uchar(rootCertificate), rootCertificateLen);

0 commit comments

Comments
 (0)