Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the X.509 RFC:

Certificate  ::=  SEQUENCE  {
     tbsCertificate       TBSCertificate,
     signatureAlgorithm   AlgorithmIdentifier,
     signature            BIT STRING  }

TBSCertificate  ::=  SEQUENCE  {
     version         [0]  Version DEFAULT v1,
     serialNumber         CertificateSerialNumber,
     signature            AlgorithmIdentifier,

Seems to me that tbsCertificate -> signature and signatureAlgorithm are redundant? That they should always be the same?

As such why include both? Why not just include one or the other?

share|improve this question

Both fields should be identical. The redundancy was apparently meant to defeat an obscure attack vector relying on weaknesses that existing signature algorithms do not have, and for unspecified goals. As Peter Gutmann says in his X.509 style guide, when talking about the signature field in the TBS:

There doesn't seem to be much use for this field, although you should check that the algorithm identifier matches the one of the signature on the cert (if someone can forge the signature on the cert then they can also change the inner algorithm identifier, it's possible that this was included because of some obscure attack where someone who could convince (broken) signature algorithm A to produce the same signature value as (secure) algorithm B could change the outer, unprotected algorithm identifier from B to A, but couldn't change the inner identifier without invalidating the signature. What this would achieve is unclear).

A sane implementation of X.509 certificate validation will use the outer field (signatureAlgorithm) to verify the signature, and will just check afterwards that the inner signature field matches the outer field (but failing to do that last verification will not actually harm security).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.