Subject: [TLS] TLSv1.2 - Is zero signature allowed in client CertificateVerify message?

From: M K Saravanan <[email-masked]>
Date: Mon, 2 Sep 2019 11:32:11 +0800

Hi,

Is zero signature allowed in client CertificateVerify message (I am
guessing may be to indicate error condition??). I don't see any thing
related to zero signature in the TLS 1.2 RFC (or may be I am not looking
into the right section?)

Today I saw a packet like this and server was terminating the connection
due to the failure of client cert auth. (because of zero signature in
client cert verify message).

Under what circumstances a client can send a zero signature in the client
CertificateVerify message?  Is this behaviour TLS 1.2 RFC compliant?

with regards,
Saravanan

---

From: Richard Barnes <[email-masked]>
Date: Tue, 3 Sep 2019 10:35:57 -0400

I don't believe that's a valid signature according to rsa_pkcs1_sha256, so
yeah, this is probably an error.
--Richard

On Sun, Sep 1, 2019 at 11:33 PM M K Saravanan <[email-masked]> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: M K Saravanan <[email-masked]>
Date: Tue, 3 Sep 2019 23:27:28 +0800

Thanks Richard for the reply.  Let me rephrase my question:

If a client encounter any error condition (e.g. does not have access to the
private key for whatever reason) in generating the signature, can it send
zero bytes in the signature field of CertificateVerify message to indicate
the error condition?  Is this allowed in TLS 1.2 RFC?

with regards,
Saravanan

---

From: David Benjamin <[email-masked]>
Date: Tue, 3 Sep 2019 11:39:51 -0400

The client should just abort the handshake and probably send an alert like
internal_error since it cannot usefully proceed.

On Tue, Sep 3, 2019 at 11:27 AM M K Saravanan <[email-masked]> wrote:

> If a client encounter any error condition (e.g. does not have access to
> the private key for whatever reason) in generating the signature, can it
> send zero bytes in the signature field of CertificateVerify message to
> indicate the error condition?  Is this allowed in TLS 1.2 RFC?
>
> with regards,
> Saravanan
>
>
>> I don't believe that's a valid signature according to rsa_pkcs1_sha256,
>> so yeah, this is probably an error.
>> --Richard
>>
>>> Under what circumstances a client can send a zero signature in the
>>> client CertificateVerify message?  Is this behaviour TLS 1.2 RFC compliant?
>>>
>>> with regards,
>>> Saravanan
>>>
>>>
>>>

---

From: M K Saravanan <[email-masked]>
Date: Wed, 4 Sep 2019 17:48:53 +0800

Thank David.

I originally encountered the zero bytes in the signature field (the
screenshot I posted in my mail) with a client device during client cert
auth.

Android Version: 6.0.1
Hardware: samsung SM-T580 (Galaxy Tab A6)

It was sending proper client Certificate, but it was sending client
CertificateVerify with zero bytes in the signature.  Hence I was wondering
whether this behaviour is allowed or not as per TLS 1.2 RFC. (for e.g. when
the client encountered an error condition; in such cases ideally I expect
the client to terminate the connection with an alert like you suggested).

Looks like a bug on the client side then.

with regards,
Saravanan

On Tue, 3 Sep 2019 at 23:40, David Benjamin <[email-masked]> wrote:

>>>> Today I saw a packet like this and server was terminating the
>>>> connection due to the failure of client cert auth. (because of zero
>>>> signature in client cert verify message).
>>>>
>>>>