Why is the Signature Algorithm listed twice in an x509 Certificate?

Question

Section 4.1 of RFC 5280 defines the contents of an x509 Certificate. Specifically, two fields are listed (signatureAlgorithm and signature) and defined to contain the same information: AlgorithmIdentifier:

4.1.  Basic Certificate Fields

  The X.509 v3 certificate basic syntax is as follows.

  Certificate  ::=  SEQUENCE  {

        tbsCertificate       TBSCertificate,
        signatureAlgorithm   AlgorithmIdentifier,            <------
        signatureValue       BIT STRING  }

  TBSCertificate  ::=  SEQUENCE  {

        version         [0]  EXPLICIT Version DEFAULT v1,
        serialNumber         CertificateSerialNumber,
        signature            AlgorithmIdentifier,            <------
        issuer               Name,
        validity             Validity,
        subject              Name,
        subjectPublicKeyInfo SubjectPublicKeyInfo,
     <-~- truncated -~->

Later, in Section 4.1.1.2, signatureAlgorithm is defined as:

4.1.1.2. signatureAlgorithm

The signatureAlgorithm field contains the identifier for the cryptographic algorithm used by the CA to sign this certificate. ... This field MUST contain the same algorithm identifier as the signature field in the sequence tbsCertificate (Section 4.1.2.3).

And in Section 4.1.2.3, signature is defined as:

4.1.2.3. Signature

This field contains the algorithm identifier for the algorithm used by the CA to sign the certificate.

This field MUST contain the same algorithm identifier as the SignatureAlgorithm field in the sequence Certificate (Section 4.1.1.2).

My question is: Why must the same piece of information be listed twice?

I could understand wanting to include the Hash algorithm and Signature generation method in the Certificate Data section so it gets included with the signature verification and is therefore not susceptible to changes.

But if that is the case, why list it again between the Certificate Data and Signature sections?

I came across other questions that seem to ask the same thing, but I did not find an answer that specifically spoke to why it is listed twice. Just that it must be listed twice.

Answer 1

I think it's a protection against certain kind of cryptographic attacks called "algorithm substitution attacks".

Please take a look here: Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute (RFC6211)

As briefly explained here: https://www.rfc-editor.org/rfc/rfc6211

In X.509 certificates, the signature algorithm is protected because it is duplicated in the TBSCertificate.signature field with the proviso that the validator is to compare both fields as part of the signature validation process.

I think it's exactly what you are looking for :)

Cheers !

Edit: Edited to add the "I think".

Edit 2: Found out that the question is duplicated... From this post: https://security.stackexchange.com/a/24796 Relating the "TBSCertificate.signature" field:

There doesn't seem to be much use for this field, although you should check that the algorithm identifier matches the one of the signature on the cert (if someone can forge the signature on the cert then they can also change the inner algorithm identifier, it's possible that this was included because of some obscure attack where someone who could convince (broken) signature algorithm A to produce the same signature value as (secure) algorithm B could change the outer, unprotected algorithm identifier from B to A, but couldn't change the inner identifier without invalidating the signature. What this would achieve is unclear).