diff options
| author | George Kadianakis <desnacked@gmail.com> | 2011-11-27 08:20:17 +0100 |
|---|---|---|
| committer | George Kadianakis <desnacked@gmail.com> | 2011-11-27 08:20:17 +0100 |
| commit | b42ff6545ac550c1e9cf6dbadea71717c210f323 (patch) | |
| tree | b0600c05f827884f18a6d58ccb8cbc06f1a3a10a | |
| parent | 58d1aa44023e8b458450c4c00d5828f768c0adb5 (diff) | |
| download | tor-b42ff6545ac550c1e9cf6dbadea71717c210f323.tar.gz tor-b42ff6545ac550c1e9cf6dbadea71717c210f323.zip | |
Use random bytes as our certificate serial numbers.
Instead of using time(NULL) in our certificate serial numbers, use
eight random bytes as suggested in proposal 179.
| -rw-r--r-- | src/common/tortls.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/src/common/tortls.c b/src/common/tortls.c index 0571b346dd..9a77bab09c 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -585,7 +585,11 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, const char *cname_sign, unsigned int cert_lifetime) { +#define SERIAL_NUMBER_SIZE 8 + time_t start_time, end_time; + BIGNUM *serial_number = NULL; + unsigned char serial_tmp[SERIAL_NUMBER_SIZE]; EVP_PKEY *sign_pkey = NULL, *pkey=NULL; X509 *x509 = NULL; X509_NAME *name = NULL, *name_issuer=NULL; @@ -606,8 +610,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, goto error; if (!(X509_set_version(x509, 2))) goto error; - if (!(ASN1_INTEGER_set(X509_get_serialNumber(x509), (long)start_time))) + + { /* our serial number is 8 random bytes. */ + if (crypto_rand((char *)serial_tmp, sizeof(serial_tmp)) < 0) + goto error; + if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL))) goto error; + if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509)))) + goto error; + } if (!(name = tor_x509_name_new(cname))) goto error; @@ -640,11 +651,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, EVP_PKEY_free(sign_pkey); if (pkey) EVP_PKEY_free(pkey); + if (serial_number) + BN_free(serial_number); if (name) X509_NAME_free(name); if (name_issuer) X509_NAME_free(name_issuer); return x509; + +#undef SERIAL_NUMBER_SIZE } /** List of ciphers that servers should select from.*/ |