c2i_ASN1_INTEGER function in Openssl 1.1.0

Question

I recently updated openssl from 1.0.2n to 1.1.0g in linux system.

Earlier I was using

ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp, long len) function. As this function is removed in openssl 1.1.0, now i replaced this with

ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp, long length) .

Now when i run my application then i get warning as

Warning:0:-- SSL Error queue report -- Warning:0: - asn1 encoding routines|d2i_ASN1_UINTEGER|expecting an integer:218718323

What is the solution for this problem?

Answer 1

ASN.1 encoding of an INTEGER (as BER or DER) consists of 1 or more "identifier" octets (usually 1), followed by 1 or more "length" octets, followed by "content" octets (the length of which is determined by the previous "length" octets).

The function c2i_ASN1_INTEGER assumes you have already parsed the "identifier" and "length" octets and coverts the "content" bytes into an integer. This was removed from OpenSSL 1.1.0 because this is considered a very low level parsing operation that applications should not be calling directly.

The function d2i_ASN1_UINTEGER is not a direct drop in replacement for c2i_ASN1_INTEGER. It parses the whole integer (including the "identifier" and "length" octets). If you pass it just the content octets then it will interpret the first byte as an "identifier" octet. This will likely have the wrong value for an integer and so this is probably why you are seeing the "expecting an integer" error.

You will need to rewrite your code to pass the whole integer to d2i_ASN1_UINTEGER.

Answer 2

Here's an example of some code that uses c2i_ASN1_INTEGER().

ASN1_get_object(&ptr, &length, &type, &xclass, end - ptr);
if (type == V_ASN1_INTEGER) {
    integer = c2i_ASN1_INTEGER(NULL, &ptr, length);
    value = ASN1_INTEGER_get(integer);
    ASN1_INTEGER_free(integer);

    // do something with value
} else
    ptr += length;

Here's how I modified the code to use d2i_ASN1_UINTEGER() instead.

save_ptr = ptr;
ASN1_get_object(&ptr, &length, &type, &xclass, end - ptr);
if (type == V_ASN1_INTEGER) {
    ptr = save_ptr;
    integer = d2i_ASN1_UINTEGER(NULL, &ptr, end - ptr);
    value = ASN1_INTEGER_get(integer);
    ASN1_INTEGER_free(integer);

    // do something with value
} else
    ptr += length;

First I saved ptr in save_ptr. ASN1_get_object() takes ptr pointing to the beginning of the BER/DER. ASN1_get_object() updates ptr to point to the content. c2i_ASN1_INTEGER() takes ptr pointing to the content, advances ptr beyond the content to point to the beginning of the next BER/DER, and returns an ASN1_INTEGER.

Now d2i_ASN1_UINTEGER() returns an ASN1_INTEGER too but it needs to take ptr pointing to the beginning of the BER/DER. So I simply set ptr back to its value before ASN1_get_object() was called. d2i_ASN1_UINTEGER() takes ptr pointing the beginning of the BER/DER, advances ptr to the beginning of the next BER/DER, and returns an ASN1_INTEGER.