bugtraq - Windows doesn't verify digital signature of CRL files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <DAC3B5AD396A0C498B8C0717899D078002D4F4B8@RED-MSG-41.redmond.corp.microsoft.com>
Date: Tue, 10 Aug 2004 16:47:35 -0700
From: "Michael Howard" <mikehow@...rosoft.com>
To: <bugtraq@...urityfocus.com>
Subject: Windows doesn't verify digital signature of CRL files

CryptoAPI in Windows will always verify the CRL signature when
determining revocation status of a certificate. While
CertVerifyCertRevocation can be used to validate certificates, we
recommend developers validate certificates using CertGetCertificateChain
in their code because it will construct a certificate chain, download
all necessary CRLs and validate the certificate chain as defined by the
IETF standard (RFC 3280) on certificate validation.

Generally we recommend devs call CertGetCertificateChain and
CertVerifyCertificateChainPolicy to validate certs rather than call
WinVerifyTrust or build their own verification algorithm using APIs such
as CertGetCRLFromStore, CertGetIssuerCertificateFromStore or
CertVerifyRevocation.

Finally, the CRL UI in Windows shows you what is in the CRL. Valid or
not. But code in Windows validates the CRL when needed.

I hope that helps...

Cheers, Michael

[Writing Secure Code 2nd Ed]
http://www.microsoft.com/mspress/books/5957.asp
[Protect Your PC] http://www.microsoft.com/protect
[Blog] http://blogs.msdn.com/michael_howard