Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm researching certificate authorities, and I just have no idea what to think of the CA named

x00Ax00-x00Tx00rx00ux00sx00tx00 x00Gx00ex00sx00.x00 x00fx00xFCx00rx00 x00Sx00ix00cx00hx00ex00rx00hx00ex00ix00tx00sx00sx00yx00sx00tx00ex00mx00ex00 x00ix00mx00 x00ex00lx00ex00kx00tx00rx00.x00 x00Dx00ax00tx00ex00nx00vx00ex00rx00kx00ex00hx00rx00 x00Gx00mx00bx00H

as indicated in the EFF observatory color CA map. Google'ing comes up with nothing. Is this an encoding of a name or something? Not that I have seen the certificate on my system or trusted by Chrome. I'm just very curious what it is and where it comes from and why is it encoded/displayed like this?

share|improve this question

1 Answer 1

up vote 11 down vote accepted

This looks like a poorly encoded name which was even more poorly decoded and reencoded.

Initially, the name seems to be: A-Trust Ges. für Sicherheitssysteme im elektr. Datenverkehr GmbH

The name was then encoded in big-endian UTF-16. In this case, this means that every character yielded two bytes, the first of which having value 0.

Upon decoding, whatever did the decoding failed to recognize the string as UTF-16 (maybe it was wrongly tagged in the certificate; an UTF-16 string should be BMPString but some cases of UTF-16 stuffed in TeletexString have been spotted in the wild; see the X.509 style guide for more about it). The string was decoded as if it was ASCII, with "invalid" bytes represented with the C-style convention of "\x" followed by two hexadecimal characters. This sequence is used in the C programming language to insert explicit byte values in literal strings. Therefore, the initial "A-T" became "\x00A\x00-\x00T". Similarly, "für" became "\x00f\x00\xFC\x00\xr" because "ü" is not an ASCII character, and has value 0xFC (aka 252) in Unicode.

When printing out the string, a further injury was inflicted on that string, namely the wholesale removal of all backslash characters. This yielded the exact string that you observe.

(Note that the EFF "CA map" shows other examples of this "C-style without backslashes" representation, e.g. "SCEE - Sistema de CertificaxE7xE3o ElectrxF3nica do Estado", which really should be "SCEE - Sistema de Certificação Electrónica do Estado".)


Now a simple Googling points to, indeed, a commercial German CA called A-Trust. Now the mystery deepens a bit, because the CA Web site uses a certificate issued by the CA itself, and the root CA uses the name: A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH, which is correctly encoded in the certificate (as an UTF8String), but is not exactly the one you observe: the "für" has been replaced with "f.".

My guess is that what you see is a previous version of the root CA certificate from that CA, and it had encoding problems, which were "solved" by changing the text into something which is pure ASCII. I.e., instead of fixing their software to handle non-ASCII characters properly, they sidestepped the issue. That's kind of sloppy.

share|improve this answer
1  
Seriously, though, I have some rather long experience of programming, so I tend to know what kind of mishap can happen with string encodings. Here, I saw the repeated "x00" which I recognized as a descendent of C notation, and the rest was easy. –  Thomas Pornin Jan 11 at 22:25
    
Well hopefully I'll be able to program/learn crypto efficiently enough to recognize such things –  ekaj Jan 11 at 22:27
    
Cool! I think the map I was looking at is from 2010 (didn't search for a more up to date one) which explains the rename. –  craastad Jan 12 at 10:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.