2
$\begingroup$

I have a signing certificate that I'm loading into an X509Certificate2 object in Visual Studio. I can't get my head around why the certificate itself has one signature algorithm, while the same certificate's public and private keys have a different signature algorithm.

Specifically:

x509Certificate.SignatureAlgorithm.FriendlyName = "sha256RSA"
x509Certificate.PrivateKey.SignatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"

Does it matter that the former is SHA-256 and the latter is SHA-1?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

I can't get my head around why the certificate itself has one signature algorithm, but the same certificate's public and private keys have a different signature algorithm.

A certificate is a document signed by an issuer (the certificate authority or "CA"), that contains a public key used to verify signatures by a subject (the "owner" of the certificate so to speak). The issuer and subject's choices of signing algorithm are independent. What's going on here is that the certificate contains a signing key with one algorithm, and the issuer signed it with a different algorithm. A very silly analogy:

  • Issuer is a notary
  • Subject is notary's client
  • Keys are pens
  • Algorithms are ink colors
  • Notary and client can use pens with different ink colors

The x509Certificate.SignatureAlgorithm field in your question seems to correspond to section 4.1.1.2 ("signatureAlgorithm") of RFC 5280:

The signatureAlgorithm field contains the identifier for the cryptographic algorithm used by the CA to sign this certificate.

The key word there is "CA"—the issuer of the certificate.

Certificates in the proper sense of the term don't include private keys, so the x509Certificate.PrivateKey property that you describe must be related to the software library that you're using. The certificate proper however, under tbsCertificate.subjectPublicKeyInfo, contains SubjectPublicKeyInfo records that specify algorithms used by the subject keys, as explained in section 4.1.2.7 ("Subject Public Key Info"):

This field is used to carry the public key and identify the algorithm with which the key is used (e.g., RSA, DSA, or Diffie-Hellman). The algorithm is identified using the AlgorithmIdentifier structure specified in Section 4.1.1.2.

And this, again, is independent of the other field, because one is for the issuer and the other is for the subject.

Does it matter that the former is sha256 and the latter are sha1?

It's not a problem that the algorithms are different, but it is one to have SHA-1 in the latter, since SHA-1 should no longer be used for public-key signatures.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Thank you for that very clear explanation. That makes perfect sense as you described it. $\endgroup$
    – maine_chap
    Oct 4, 2018 at 18:22
  • $\begingroup$ The perfect analogy. $\endgroup$
    – kelalaka
    Oct 4, 2018 at 19:07
  • $\begingroup$ ... and certificates are certificates and signatures are signatures ... I agree, great analogy. $\endgroup$
    – Maarten Bodewes ♦
    Oct 4, 2018 at 19:17
  • $\begingroup$ Interesting... could this answer also provide an answer to this question? Or have I misunderstood? $\endgroup$
    – Eddie
    Oct 4, 2018 at 21:26
  • $\begingroup$ @Eddie: No, that's a third occurrence of AlgorithmIdentifier apart from the two that I mention in my answer. See section 4.1.2.3 of RFC 5280. $\endgroup$
    – Luis Casillas
    Oct 4, 2018 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.