mirleft/ocaml-x509 — pull request #22 by pqwy (2014-09-29 18:32:33+00:00)
Title: Tighten up `Algorithm` ASN grammar

... its `params` field is notoriously underspecified. We used to accept either
absent or null params for algorithms that don't have params; this code accepts
only explicit `null` (or nothing for the `ECDSA` group).

See https://www.cdc.informatik.tu-darmstadt.de/reports/reports/sigflaw.pdf
section 5; it was referenced in Langley's blog.

N.B. We weren't realistically vulnerable before since we used to accept only two
representations for hash algorithms, but better safe than sorry.