Unused bits in asn1 bit string

[moshe-shahar]

Description

• Type: Bug
• Priority: Minor

mbed TLS build:
Version: 2.8.0 (latest)

---

Bugs

The unused bits in mbedtls_asn1_write_bitstring are not as expected and should contain also the trailing zeros.
Tested against Python cryptography library

From spec:

Named bit lists are BIT STRINGs where the values have been assigned
names. This specification makes use of named bit lists in the
definitions for the key usage, CRL distribution points, and freshest
CRL certificate extensions, as well as the freshest CRL and issuing
distribution point CRL extensions. When DER encoding a named bit
list, trailing zeros MUST be omitted. That is, the encoded value
ends with the last named bit that is set to one.

[RonEld]

For reference, the The quote is from RFC5280 Appendix B

[RonEld]

@moshe-shahar Please specify what is the current behavior, what is the expected behavior and how to reproduce.

[moshe-shahar]

Current behavior is to set the unused bits field in the DER to modulo 8 on bits argument.
Expected behavior is set the unused bits field to include the trailing zeros.
Example for 1000000 bit string with 7 bits len:
Current unused bits is 1.
Expected is 7 (1+6 trailing zeros).

[trianglee]

@sbutcher-arm This defect is now biting us - we cannot encode a specific field we need to encode in a CSR. Is there any forecast to when this could be looked at?

[ciarmcom]

ARM Internal Ref: IOTSSL-2526

[hanno-becker]

@moshe-shahar I think we need to distinguish between raw bitstrings, which may include trailing zero bits, and named bit lists, for which such are forbidden in DER. Changing mbedtls_asn1_write_bitstring() to remove trailing bits doesn't seem to be the right approach to me. Instead, I think we should add a new pair of API calls for parsing and writing named bit lists. See #2028 for more details. Apologies if I mixed up things, please let me know if you see the matter differently.

[moshe-shahar]

@hanno-arm, I can't comment or suggest what is the correct fix since I'm not sure I'm familiar with all cases this library should support.