An OpenSSL-based implementation of the Certificate Management Protocol (CMP), defined in IETF RFCs 4210, 4211, and 6712. It is being extended according to the emerging RFCs 'CMP Updates' (CMPv3), 'CMP Algorithms', and 'Lightweight CMP Profile'.
During a test enrolling with an empty subject field the POPO check returned a weird error.
Having a closer look at OSSL_CRMF_MSGS_verify_popo() I found that
its error handling is poor - I'll fix this soon.
in the case sig->poposkInput != NULL the signature is verified but the contents of the authInfo sub-field, which is defined in RFC 4211 https://tools.ietf.org/html/rfc4211#section-4.1 as given below, are not checked at all - I'll add a TODO.
* authInfo CHOICE {
* sender [0] GeneralName,
* -- used only if an authenticated identity has been
* -- established for the sender (e.g., a DN from a
* -- previously-issued and currently-valid certificate)
* publicKeyMAC PKMACValue },
* -- used if no authenticated GeneralName currently exists for
* -- the sender; publicKeyMAC contains a password-based MAC
* -- on the DER-encoded value of publicKey
During a test enrolling with an empty subject field the POPO check returned a weird error. Having a closer look at
OSSL_CRMF_MSGS_verify_popo()I found thatsig->poposkInput != NULLthe signature is verified but the contents of theauthInfosub-field, which is defined in RFC 4211 https://tools.ietf.org/html/rfc4211#section-4.1 as given below, are not checked at all - I'll add a TODO.