Правильно ли я предполагаю, что в запросе или сертификате X509 есть защита от изменения как информации о субъекте, так и о расширении?
Эта подпись - просто еще один элемент, встроенный в кодировку ASN.1?
Ты прав. Целостность обоих этих элементов может быть подтверждена цифровыми подписями запроса (подписанного закрытым ключом запрашивающей стороны) или сертификатом (подписанным закрытым ключом CA).
Редактировать:
RFC 2986, раздел 3, описывающий запросы сертификатов PKCS # 10:
3. Overview A certification request consists of three parts: "certification request information," a signature algorithm identifier, and a digital signature on the certification request information....
1. A CertificationRequestInfo value containing a subject distinguished name, a subject public key, and optionally a set of attributes is constructed by an entity requesting certification. 2. The CertificationRequestInfo value is signed with the subject entity's private key. (See Section 4.2.)
и страница 5:
The components of type CertificationRequestInfo have the following meanings:...
attributes is a collection of attributes providing additional information about the subject of the certificate. Some attribute types that might be useful here are defined in PKCS ... certificate revocation. Another example is information to appear in X.509 certificate extensions (e.g. the extensionRequest attribute from PKCS #9). The values of type
RFC 5280 re: сертификаты x.509:
4.1.1.3. signatureValue The signatureValue field contains a digital signature computed upon the ASN.1 DER encoded tbsCertificate. The ASN.1 DER encoded tbsCertificate is used as the input to the signature function. ... 4.1.2. TBSCertificate The sequence TBSCertificate contains information associated with the subject of the certificate and the CA that issued it. Every TBSCertificate contains the names of the subject and issuer, a public key associated with the subject, a validity period, a version number, and a serial number; some MAY contain optional unique identifier fields. The remainder of this section describes the syntax and semantics of these fields. A TBSCertificate usually includes extensions.