Why sbverify needs a certificate to verify digital signatures?

Wael Sadek

4/22/24, 4:43 AM

sbverify needs a certificate to verify digital signatures. I wonder why it's needed, since the signer certificate is already included in the digital signature itself ?

1 + 0

Score:1

Crypto

Maarten Bodewes

4/22/24, 7:15 AM

The idea of verification using certificates is that a trust path is build towards a trust anchor - usually also just a certificate. The trust anchor may also be linked to some additional name constraints for the underlying certificates. Trust path (certificate chain) validation is listed in the X.509 specifications.

It is of course possible to verify the signature of anything as long as the verifier has access to the public key. Anybody - including an attacker - can however create a key pair, a (self signed) certificate or certificate tree and create a signature - so any certificate included with the signature cannot be trusted by itself. The idea of PKIX is that you do not just verify the signature but that you also verify all the certificates up to a trusted certificate. The certificates included with the signatures are by themselves not trusted.

Signature verification is only part of the full verification process though, the certificates themselves also need to be validated and preferably the status of the certificates should be verified. The latter is of course tricky for embedded applications as the embedded device may not have access to a Certificate Revocation List (CRL) or an Online Certificate Status Protocol.

What's very likely required of your software is that you supply it a certificate or set of certificates that together form a trust path. The included certificate may be part of that if there is a 1:1 situation where only one certificate can do the signing. Otherwise the chain usually contains intermediate CA and/or root certificates. A quick look at the changelog for the software shows that there was a recent fix regarding intermediate certificates for instance.

+ 4

Wael Sadek

4/24/24, 8:44 PM

This doesn't answer my question. I've created a self signed certificate and signed a file via `sbsign` with both the self signed certificate and the key. `sbverify` works well given the self signed certificate. My question is why doesn't it use the one in the digital signature. I've verified that the self signed certificate is already included in the digital signature.

Maarten Bodewes

4/24/24, 9:51 PM

I did answer your question but I've added a few lines, hope I get the point across this time.

Wael Sadek

4/25/24, 5:47 PM

So `sbverify` requires the certificate just to ensure that's the correct one ? And the one in the digital signature just to identify who signed it ?

Maarten Bodewes

4/25/24, 9:34 PM

Self signed certs are a bit weird. Generally the trusted certificate doesn't need to be in the certificate chain within the signature. However, without a certificate you could not build a trust path. I'd guess that you'd normally use the one that is used as a trust anchor (keeping to the original validity period, for instance), but in practice / the good scenario they should of course be identical.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why sbverify needs a certificate to verify digital signatures?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.