search

sigstore / timestamp-authority

RFC3161 Timestamp Authority
Apache License 2.0
67 stars 38 forks source link

`TimestampResponse.Time` is not in UTC #846

Closed DarkaMaul closed 1 month ago

DarkaMaul commented 1 month ago

Description

When generating a TimestampResponse, the time is returned as a Localized time instead of UTC.

Example: link

However, in RFC5280, the time field is supposed to ends with Z and be expressed in Greenwich Mean Time ( source )

The real culprit here is go itself.

Version : I'm on main

woodruffw commented 1 month ago

However, in RFC5280, the time field is supposed to ends with Z and be expressed in Greenwich Mean Time ( source )

On top of this: even outside of the RFC 5280 profile, DER requires that GeneralizedTime be encoded with Z, and not with any relative timezone offsets.

This restriction can be found in X.690 11.7.1, which is on page 19 of the spec: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf

So TL;DR: this needs to be a Z to be a valid encoding, and most conforming DER parsers will reject it if it isn't 🙂