Nonce implementation might be buggy #1

I've been working on sigstore-rs and had issues with the nonce generation.

I believe your implementation might also suffer from a bug: When nonce[0] has values 0x80-0xFF (50% of the time), the Int will be interpreted as negative, which violates the RFC 3161 requirement that nonces be positive integers.

Here is a patch that was added to the Python library: https://github.com/trailofbits/rfc3161-client/pull/33/files

Thank you a lot for the hint! I will have a look regarding my implementation.

Thanks!

I checked the RFC 3161 again and couldn't find a requirement for the nonce being a positive integer value. The example in the definition even mentions a signed type:

The nonce is a large random number with a high probability that the client generates it only once (e.g., a 64 bit integer).

Maybe I am missing something there. Can you give me a hint from where the requirement for a positive value can be derived, @wolfvollprecht?

I can't really, just that the https://timestamp.sigstore.dev/api/v1/timestamp endpoint seemed to reject nonces with negative values.

Our working implementation (similar to trail of bits) here: github.com/prefix-dev/sigstore-rust@3818f0afd0/crates/sigstore-tsa/src/asn1.rs