Verification and authentication flow for X509 code-singing certificate

Question

I am developing an embedded devices FW updates (not connected to the internet) and I am using code-signing certificates in order to verify the FW update issuer identity (the FW update is signed with our private key). I implemented an ASN.1 parser in FW (can't use some known implementation because of memory restrictions) and it works well. I also have the root-CA's public key downloaded to the device in a secured manner during the production process. My question is :

When I looked for a common flow of certificate authentication and verification algorithm its stated everywhere that I should check the hostName (CN) of the CA that issued the certificate as well as the name and details if the CSR issuer. I can't seem to understand why simply checking the signature is not enough for my needs, I have the CA public key already installed so that any certificate which wasn't signed by this specific CA will fail RSA authentication. Is there a reason why I should also check the content of the certificate and not only the signature ?

Thanks ,

Answer 1

If you are storing a trusted CA's public key, then you may not need to do any more. This assumes a couple of things:

• The CA will never perform any revocation
• All of the signatures you check will be generated by the same CA

It is also important to be aware that the CA will expire at some point (as indicated in the CA cert), and there may come a point that you stop trusting this CA. You should have some way to stop your code from trusting things signed by the CA.

You don't really need to go the full route unless you are dealing with many potential intermediate CAs, signed by a few roots (that you still hard code). Because you will only evaluate the intermediate CA when you see it, you will need to perform a full set of verifications. What you gain by going this route is that you can trust many more CAs, and you get to check to see if anything in the chain has been revoked.