Repository navigation
Align CMS digest and signing algos with empty and NULL parameters - #315
Open
ericb-apple wants to merge 1 commit into
Open
ericb-apple wants to merge 1 commit into
ericb-apple wants to merge 1 commit into
Conversation
Motivation: * PKCS1v1.5 implementations treat having no parameters and NULL parameters as equivalent * Omit SHA2 optional parameters from AlgorithmIdentifiers (per RFC 5754 § 2) while accepting those with NULL parameters X509/CryptographicMessageSyntax/CMSOperations.swift attempts direct equality check between signature algorithm and signer digest algorithm including the parameters, and failing in situations where: * ASN1Null and Swift nil parameters being considered not equivalent * SHA2 with parameters and ASN1Null or Swift nil parameters being considered not equivalent Modifications: When verifying whether digest and signing algorithms match in CMS signature verification: * Treat ASN1Null and Swift nil parameters as equivalent * Correct internal representation of the signer digest algorithm to have Swift nil parameters for the equality check for SHA2 Result: CMS signature successfully verifies for PKCS1v1.5 payloads and usage of SHA2 parameters with mixture of empty, optional, and NULL parameters.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
X509/CryptographicMessageSyntax/CMSOperations.swiftattempts direct equality check between signature algorithm and signer digest algorithm including the parameters, and failing in situations where:ASN1Nulland Swiftnilparameters being considered not equivalentModifications
When verifying whether digest and signing algorithms match in CMS signature verification:
ASN1Nulland Swiftnilparameters as equivalentnilparameters for the equality check for SHA2Result
CMS signature successfully verifies for PKCS1v1.5 payloads and usage of SHA2 parameters with mixture of empty, optional, and NULL parameters.