martinisecurity / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
0 stars 0 forks source link

Serial number length check is incorrect #11

Open fenichelar opened 8 months ago

fenichelar commented 8 months ago

The lint_serial_number_size check is incorrect. ATIS-1000080.v005 says at least 64 bits of output from a CSPRNG must be used, not that the serial number must be at least 64 bits long. If 64 bits of output from a CSPRNG are used, it is possible that the serial number will be less than 64 bits long.