trustedjava-support

[Trustedjava-support] Problem with validation of AIK Certificate

[<dev...@ar...>]

Hello,

I have set up and running the apki0.2-server. I do the following steps:

1. I create a EK-Certificate
2. With this EK - Certificate, I create a AIK-Certificate

This steps works just fine as well as validation of the EK-Cert. But if I want to validate AIK-Cert I
always receive the following result 

=== running VALIDATE_AIK_REQUEST
15:54:47:775 [INFO] PkiServerCommand::action_validate_aik_request (193):        received: #20090611155249983, 1111113
15:54:47:776 [INFO] PkiServerCommand::action_validate_aik_request (199):        status: INDETERMINATE

The commands aik_locate and aik_revoke also works as expected.

Further investigation, which I have done 
- Debugging the server part, which leads me to the following exception in the file ValidateCertFile.java function validate
Signature decryption error: javax.crypto.BadPaddingException: Invalid PKCS#1 padding: encrypted message and modulus    lengths do not match!

I hope someone could give me some advice.

Thanks,
Jan

The version I use
APKI: 0.2-20090302-102854-r908c90aa
jTSS_TSP: 0.4a 20090227 14:43:27
TCcert: 0.2.2a-20080709-114558

Re: [Trustedjava-support] Problem with validation of AIK Certificate

[Martin P. <Mar...@ia...>]

Have a nice monday morning...

dev...@ar... wrote:
> - Debugging the server part, which leads me to the following exception in the file ValidateCertFile.java function validate
> Signature decryption error: javax.crypto.BadPaddingException: Invalid PKCS#1 padding: encrypted message and modulus    lengths do not match!

Decryption failure with PKCS#1 padding errors typically occur when
one uses the wrong key for decryption.
E.g., you receive the same error if you want to try our demo server
setup to create an AIK certificate, but use the credentials which are
included in the apki package and not the matching ones from the demo
server homepage.

Why this happens in your setup with just aik_validate I can't say,
have a look at your configuration which certificate (chains) are
actually loaded and used for validation.

As you can see from the validation module code it is very basic.
In a real production setup one would hook up an industrial PKI
validation module, but that wasn't the primary development goal
for this experimental prototype PrivacyCA setup.

HTH,
Martin