We have encountered a problem with SFL processing some DSA Certificates, which are attached in a PKCS12 file whose password is password. John Stark has produced the following analysis. 1. The DSA certificates that cause the "Montgomery" error have 512-bit keys, whereas our own have 1024-bit keys. 2. The error is reported because SFL, including the common "CTIL manager" library and the "sm_free3 CTIL" library that interfaces to crypto++ (though not crypto++ itself) has burnt-in assumptions that DSA keys are 1024-bit. I have found this in a number of places in the code. There are one or two places that do realise that DSA keys can be smaller, but many more that don't. 3. I confirmed this by putting debug printfs in the crypto++ routine that reports the error, and determining that it is passed 64 bytes of modulus rather than 32 (in native byte order, i.e. reversed from the ASN.1), the first 32 of which are garbage, mostly zero, and the 2nd 32 of which are those from the ASN.1. 4. The 512-bit DSA keys and certificates work correctly when used with Microsoft CryptoAPI. ----------------------------------------------------------------------- Clearswift monitors, controls and protects all its messaging traffic in compliance with its corporate email policy using Clearswift products. Find out more about Clearswift, its solutions and services at http://www.clearswift.com ******************************************************************************************************** This communication is confidential and may contain privileged information intended solely for the named addressee(s). It may not be used or disclosed except for the purpose for which it has been sent. If you are not the intended recipient, you must not copy, distribute or take any action in reliance on it. Unless expressly stated, opinions in this message are those of the individual sender and not of Clearswift. If you have received this communication in error, please notify Clearswift by emailing support@xxxxxxxxxxxxxx quoting the sender and delete the message and any attached documents. Clearswift accepts no liability or responsibility for any onward transmission or use of emails and attachments having left the Clearswift domain.
Attachment:
TestCerts.pfx
Description: application/ftbp.1.2.840.1.113694.2.2.1.1