As I read some parts of the X.509 specification I found the signature added twice - first in the AttributeCertificate as signatureAlgorithm and second in the AttributeCertificateInfo as signature. Could you explain me why? The same goes for the Basic Certificate Fields.

signature: This field MUST contain the same algorithm identifier as the signatureAlgorithm field in the sequence Certificate

AttributeCertificate ::= SEQUENCE {
  acinfo               AttributeCertificateInfo,
  signatureAlgorithm   AlgorithmIdentifier,
  signatureValue       BIT STRING

AttributeCertificateInfo ::= SEQUENCE {
  version                 AttCertVersion, -- version is v2
  holder                  Holder,
  issuer                  AttCertIssuer,
  signature               AlgorithmIdentifier,
  serialNumber            CertificateSerialNumber,
  attrCertValidityPeriod  AttCertValidityPeriod,
  attributes              SEQUENCE OF Attribute,
  issuerUniqueID          UniqueIdentifier OPTIONAL,
  extensions              Extensions OPTIONAL

This is a remnant of some old fears. Peter Gutmann's X.509 Style Guide, an old (2001) but instructive read, includes the following paragraph:

This rather misnamed field contains the algorithm identifier for the signature algorithm used by the CA to sign the certificate. There doesn't seem to be much use for this field, although you should check that the algorithm identifier matches the one of the signature on the cert (if someone can forge the signature on the cert then they can also change the inner algorithm identifier, it's possible that this was included because of some obscure attack where someone who could convince (broken) signature algorithm A to produce the same signature value as (secure) algorithm B could change the outer, unprotected algorithm identifier from B to A, but couldn't change the inner identifier without invalidating the signature. What this would achieve is unclear).

So one might infer that, one day, probably around a coffee machine during a pause between two meetings, somebody made an elaborate but not really funny crypto-joke, and it was overheard by somebody else, who did not get it, and proceeded to stir up feelings of anxiety somewhere in the dark corner of a sub-committee. More generally, X.509 makes a lot more sense if you read it as Mary Shelley's draft notes for "Frankenstein", translated for some reason into ancient Ugaritic.

  • May I quote that last sentence on my next lectur on X.509? – Jenny D Mar 10 '17 at 14:24
  • Be my guest.... – Thomas Pornin Mar 10 '17 at 14:37
  • Making the algorithm part of the signed data is certainly a good idea. This answer mentions RFC 6211, which is relatively recent and proposes that CMS should do as X.509. – pgianna Mar 10 '17 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.