3
$\begingroup$

I'm wondering why there are two Algorithm Identifiers in a X509 certificate. One is in the "to be signed" part and the other one is at the end right before the actual signature.

Are they used for the same purpose? Do they have to be the same? Can implementations choose which of these two fields they evaluate?

$\endgroup$
2
$\begingroup$

I'm assuming you're talking about these two fields:

  • signature
  • signatureAlgorithm

following the names defined in RFC 5280 section 4.1. And section 4.1.1.2 then goes on to state (for signatureAlgorithm):

This field MUST contain the same algorithm identifier as the signature field in the sequence tbsCertificate (Section 4.1.2.3).

So, yes, they have to be the same.

$\endgroup$
  • $\begingroup$ Yes, that's what I'm talking about. Thanks for your profound answer. Is this a design flaw, then? $\endgroup$ – Nocta Oct 12 '15 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.