Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Commit 5bc389f

Browse files
bartonjsbartonjs
committed
Added additional OIDs for RSA-SSA-PKCS1.5 CMS signatures
This enables processing documents which use the X.509 hybrid identifier (e.g. `sha256WithRSAEncryption`) instead of `rsaEncryption`.
1 parent cd64b00 commit 5bc389f

5 files changed

Lines changed: 176 additions & 1 deletion

File tree

‎src/System.Security.Cryptography.Pkcs/src/Internal/Cryptography/Oids.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ internal static class Oids
1919
public const string Rsa = "1.2.840.113549.1.1.1";
2020
public const string RsaOaep = "1.2.840.113549.1.1.7";
2121
public const string RsaPss = "1.2.840.113549.1.1.10";
22+
public const string RsaPkcs1Sha1 = "1.2.840.113549.1.1.5";
23+
public const string RsaPkcs1Sha256 = "1.2.840.113549.1.1.11";
24+
public const string RsaPkcs1Sha384 = "1.2.840.113549.1.1.12";
25+
public const string RsaPkcs1Sha512 = "1.2.840.113549.1.1.13";
2226
public const string Esdh = "1.2.840.113549.1.9.16.3.5";
2327

2428
// Cryptographic Attribute Types

‎src/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.RSA.cs‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,25 @@ internal partial class CmsSignature
1515
{
1616
static partial void PrepareRegistrationRsa(Dictionary<string, CmsSignature> lookup)
1717
{
18-
lookup.Add(Oids.Rsa, new RSAPkcs1CmsSignature());
18+
lookup.Add(Oids.Rsa, new RSAPkcs1CmsSignature(null, null));
19+
lookup.Add(Oids.RsaPkcs1Sha1, new RSAPkcs1CmsSignature(Oids.RsaPkcs1Sha1, HashAlgorithmName.SHA1));
20+
lookup.Add(Oids.RsaPkcs1Sha256, new RSAPkcs1CmsSignature(Oids.RsaPkcs1Sha256, HashAlgorithmName.SHA256));
21+
lookup.Add(Oids.RsaPkcs1Sha384, new RSAPkcs1CmsSignature(Oids.RsaPkcs1Sha384, HashAlgorithmName.SHA384));
22+
lookup.Add(Oids.RsaPkcs1Sha512, new RSAPkcs1CmsSignature(Oids.RsaPkcs1Sha512, HashAlgorithmName.SHA512));
1923
lookup.Add(Oids.RsaPss, new RSAPssCmsSignature());
2024
}
2125

2226
private abstract class RSACmsSignature : CmsSignature
2327
{
28+
private readonly string _signatureAlgorithm;
29+
private readonly HashAlgorithmName? _expectedDigest;
30+
31+
protected RSACmsSignature(string signatureAlgorithm, HashAlgorithmName? expectedDigest)
32+
{
33+
_signatureAlgorithm = signatureAlgorithm;
34+
_expectedDigest = expectedDigest;
35+
}
36+
2437
internal override bool VerifySignature(
2538
#if netcoreapp
2639
ReadOnlySpan<byte> valueHash,
@@ -34,6 +47,15 @@ internal override bool VerifySignature(
3447
ReadOnlyMemory<byte>? signatureParameters,
3548
X509Certificate2 certificate)
3649
{
50+
if (_expectedDigest.HasValue && _expectedDigest.Value != digestAlgorithmName)
51+
{
52+
throw new CryptographicException(
53+
SR.Format(
54+
SR.Cryptography_Cms_InvalidSignerHashForSignatureAlg,
55+
digestAlgorithmOid,
56+
_signatureAlgorithm));
57+
}
58+
3759
RSASignaturePadding padding = GetSignaturePadding(
3860
signatureParameters,
3961
digestAlgorithmOid,
@@ -67,6 +89,11 @@ protected abstract RSASignaturePadding GetSignaturePadding(
6789

6890
private sealed class RSAPkcs1CmsSignature : RSACmsSignature
6991
{
92+
public RSAPkcs1CmsSignature(string signatureAlgorithm, HashAlgorithmName? expectedDigest)
93+
: base(signatureAlgorithm, expectedDigest)
94+
{
95+
}
96+
7097
protected override RSASignaturePadding GetSignaturePadding(
7198
ReadOnlyMemory<byte>? signatureParameters,
7299
string digestAlgorithmOid,
@@ -147,6 +174,10 @@ protected override bool Sign(
147174

148175
private class RSAPssCmsSignature : RSACmsSignature
149176
{
177+
public RSAPssCmsSignature() : base(null, null)
178+
{
179+
}
180+
150181
protected override RSASignaturePadding GetSignaturePadding(
151182
ReadOnlyMemory<byte>? signatureParameters,
152183
string digestAlgorithmOid,

‎src/System.Security.Cryptography.Pkcs/tests/Oids.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ internal static class Oids
2323

2424
// Asymmetric encryption algorithms
2525
public const string Rsa = "1.2.840.113549.1.1.1";
26+
public const string RsaPkcs1Sha256 = "1.2.840.113549.1.1.11";
2627
public const string Esdh = "1.2.840.113549.1.9.16.3.5";
2728
public const string Dh = "1.2.840.10046.2.1";
2829

‎src/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1060,6 +1060,27 @@ public static void AddSignerToUnsortedAttributeSignature()
10601060
cms.CheckSignature(true);
10611061
}
10621062

1063+
[Fact]
1064+
public static void CheckSignature_Pkcs1_RsaWithSha256()
1065+
{
1066+
SignedCms signedCms = new SignedCms();
1067+
signedCms.Decode(SignedDocuments.RsaPkcs1Sha256WithRsa);
1068+
1069+
// Assert.NoThrows
1070+
signedCms.CheckSignature(true);
1071+
}
1072+
1073+
[Fact]
1074+
public static void CheckSignature_Pkcs1_Sha1_Declared_Sha256WithRsa()
1075+
{
1076+
SignedCms signedCms = new SignedCms();
1077+
signedCms.Decode(SignedDocuments.RsaPkcs1SignedSha1DeclaredSha256WithRsa);
1078+
1079+
Assert.Throws<CryptographicException>(() => {
1080+
signedCms.CheckSignature(true);
1081+
});
1082+
}
1083+
10631084
[Theory]
10641085
[InlineData(null, "0102", Oids.Pkcs7Data)]
10651086
[InlineData(null, "010100", Oids.Pkcs7Data)]

‎src/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedDocuments.cs‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -767,5 +767,123 @@ internal static class SignedDocuments
767767
"101711B9C6AC5C5776923C699E772B07864755C1AC50F387655C4E67DB356207" +
768768
"76252A2F4605B97BD3C299D1CD79929273BB86E7DF9E113C92802380ED6D4041" +
769769
"9DA4C01214D4FA24").HexToByteArray();
770+
771+
internal static readonly byte[] RsaPkcs1Sha256WithRsa = (
772+
"3082071B06092A864886F70D010702A082070C30820708020101310F300D0609" +
773+
"6086480165030402010500301606092A864886F70D010701A009040700010203" +
774+
"040506A08205223082051E30820406A00302010202100D85090F3FACFF0A9008" +
775+
"A12A9FB00A54300D06092A864886F70D01010B05003072310B30090603550406" +
776+
"1302555331153013060355040A130C446967694365727420496E633119301706" +
777+
"0355040B13107777772E64696769636572742E636F6D3131302F060355040313" +
778+
"2844696769436572742053484132204173737572656420494420436F64652053" +
779+
"69676E696E67204341301E170D3138303832393030303030305A170D31393039" +
780+
"30333132303030305A305B310B3009060355040613025553310B300906035504" +
781+
"0813025641311330110603550407130A416C6578616E64726961311430120603" +
782+
"55040A130B4B6576696E204A6F6E6573311430120603550403130B4B6576696E" +
783+
"204A6F6E657330820122300D06092A864886F70D01010105000382010F003082" +
784+
"010A0282010100F1F4542FF6CA57FBC44986EC816F07D1FD50BFD477C412D299" +
785+
"1C962D0A22194A4296BCD0751F47CE4932F73871277CE3CDD2C78157599C7A35" +
786+
"80CC96A11F7031E3A798F4BAA93988F0E4077D30316252B24337DB26914E1F77" +
787+
"9CB4979544514B0234E5388E936B195B91863B258F0C8951454D3668F0C4D456" +
788+
"A8497758D21C433626E46F2CFF5A7CC7945F788948998E5F8786E1E990E240BB" +
789+
"0780CD258F57761AFB5D42AD8E3D703C3126861E83F191ECE9F0B83221F96214" +
790+
"533B2A47977F43715FE501FBC4A4040839DD3EBCA8B67259A7DD0EA9EFAE2200" +
791+
"943EFB7D0404B8978B49A445849B5F6898B06269F427F30DBC8DB2FD7963943A" +
792+
"8C461760E6A4F30203010001A38201C5308201C1301F0603551D230418301680" +
793+
"145AC4B97B2A0AA3A5EA7103C060F92DF665750E58301D0603551D0E04160414" +
794+
"33795EB2D84BFAA3F96E5930F64EC6A94C6FD36A300E0603551D0F0101FF0404" +
795+
"0302078030130603551D25040C300A06082B0601050507030330770603551D1F" +
796+
"0470306E3035A033A031862F687474703A2F2F63726C332E6469676963657274" +
797+
"2E636F6D2F736861322D617373757265642D63732D67312E63726C3035A033A0" +
798+
"31862F687474703A2F2F63726C342E64696769636572742E636F6D2F73686132" +
799+
"2D617373757265642D63732D67312E63726C304C0603551D2004453043303706" +
800+
"096086480186FD6C0301302A302806082B06010505070201161C68747470733A" +
801+
"2F2F7777772E64696769636572742E636F6D2F4350533008060667810C010401" +
802+
"30818406082B0601050507010104783076302406082B06010505073001861868" +
803+
"7474703A2F2F6F6373702E64696769636572742E636F6D304E06082B06010505" +
804+
"0730028642687474703A2F2F636163657274732E64696769636572742E636F6D" +
805+
"2F446967694365727453484132417373757265644944436F64655369676E696E" +
806+
"6743412E637274300C0603551D130101FF04023000300D06092A864886F70D01" +
807+
"010B0500038201010045B9D9868E494BD02635D0E42DDE80B37A865C389CFDD9" +
808+
"9BFC9B62E2C169A73B5EABF282607439EFF5C61630886DEB63415B53683446A7" +
809+
"3041686C326BA35FF0029FEF603D7C80FA0177A4DE35013529B01F759FD50414" +
810+
"79BDBB6B93B18144CB14E431BC144146848EF8ADB0E28952EAD1BB49E8547FFE" +
811+
"9934817036338B20C4E0B9D7C6A4E5BE3D57157F21904A5C864946313EA6B7D9" +
812+
"50EE0235B5D2CD01490AD2B2A1AB5F66EC8986D64A1D9D239C131E09E5CA1C02" +
813+
"A75F2D7EC07E4C858856A6A58AB94DEAC8B3D3A5BBF492EE2463B156E6A0660B" +
814+
"B452E35922D00456F0DEE0ED15A8BF8FFF31008756B14EEE0AC14BCF19A3CD16" +
815+
"819DC990F5F45CDE21318201B2308201AE0201013081863072310B3009060355" +
816+
"04061302555331153013060355040A130C446967694365727420496E63311930" +
817+
"17060355040B13107777772E64696769636572742E636F6D3131302F06035504" +
818+
"03132844696769436572742053484132204173737572656420494420436F6465" +
819+
"205369676E696E6720434102100D85090F3FACFF0A9008A12A9FB00A54300D06" +
820+
"096086480165030402010500300D06092A864886F70D01010B050004820100E2" +
821+
"980C5A30EC00729D1CFA826D7A65B43FF6806B5E0ABA23A78E4F1CAA3F6436EF" +
822+
"00941C6947A9B8F20D0757B5346CF640AA217F7361BEEFF2BC997FB1D3597BF3" +
823+
"D7457BD4A94062FB03660F9D86710BE2FC99876A848251F4965E1B16192714C8" +
824+
"F9788C09CCDE83603ADC919297BA496E921B95F3BD9554A873E09912640FCFAA" +
825+
"D9DD1441D1851E637031D390C038223AE64B048E806462DDBAC98C156BE2EE47" +
826+
"2B78166BDB1612848B535ADC3F0E7BE52991A17F48AFDCCC1698A236BA338930" +
827+
"50EBAAC4460DAA35185C16670F597E0E6E0CB0AA83F51AAEF452F3367DD9350A" +
828+
"8A49A5A8F79DF8E921303AB5D6646A482F0F59D9980310E1AE3EE8D77CB857").HexToByteArray();
829+
830+
internal static readonly byte[] RsaPkcs1SignedSha1DeclaredSha256WithRsa = (
831+
"3082071306092A864886F70D010702A082070430820700020101310B30090605" +
832+
"2B0E03021A0500301606092A864886F70D010701A009040700010203040506A0" +
833+
"8205223082051E30820406A00302010202100D85090F3FACFF0A9008A12A9FB0" +
834+
"0A54300D06092A864886F70D01010B05003072310B3009060355040613025553" +
835+
"31153013060355040A130C446967694365727420496E6331193017060355040B" +
836+
"13107777772E64696769636572742E636F6D3131302F06035504031328446967" +
837+
"69436572742053484132204173737572656420494420436F6465205369676E69" +
838+
"6E67204341301E170D3138303832393030303030305A170D3139303930333132" +
839+
"303030305A305B310B3009060355040613025553310B30090603550408130256" +
840+
"41311330110603550407130A416C6578616E6472696131143012060355040A13" +
841+
"0B4B6576696E204A6F6E6573311430120603550403130B4B6576696E204A6F6E" +
842+
"657330820122300D06092A864886F70D01010105000382010F003082010A0282" +
843+
"010100F1F4542FF6CA57FBC44986EC816F07D1FD50BFD477C412D2991C962D0A" +
844+
"22194A4296BCD0751F47CE4932F73871277CE3CDD2C78157599C7A3580CC96A1" +
845+
"1F7031E3A798F4BAA93988F0E4077D30316252B24337DB26914E1F779CB49795" +
846+
"44514B0234E5388E936B195B91863B258F0C8951454D3668F0C4D456A8497758" +
847+
"D21C433626E46F2CFF5A7CC7945F788948998E5F8786E1E990E240BB0780CD25" +
848+
"8F57761AFB5D42AD8E3D703C3126861E83F191ECE9F0B83221F96214533B2A47" +
849+
"977F43715FE501FBC4A4040839DD3EBCA8B67259A7DD0EA9EFAE2200943EFB7D" +
850+
"0404B8978B49A445849B5F6898B06269F427F30DBC8DB2FD7963943A8C461760" +
851+
"E6A4F30203010001A38201C5308201C1301F0603551D230418301680145AC4B9" +
852+
"7B2A0AA3A5EA7103C060F92DF665750E58301D0603551D0E0416041433795EB2" +
853+
"D84BFAA3F96E5930F64EC6A94C6FD36A300E0603551D0F0101FF040403020780" +
854+
"30130603551D25040C300A06082B0601050507030330770603551D1F0470306E" +
855+
"3035A033A031862F687474703A2F2F63726C332E64696769636572742E636F6D" +
856+
"2F736861322D617373757265642D63732D67312E63726C3035A033A031862F68" +
857+
"7474703A2F2F63726C342E64696769636572742E636F6D2F736861322D617373" +
858+
"757265642D63732D67312E63726C304C0603551D200445304330370609608648" +
859+
"0186FD6C0301302A302806082B06010505070201161C68747470733A2F2F7777" +
860+
"772E64696769636572742E636F6D2F4350533008060667810C01040130818406" +
861+
"082B0601050507010104783076302406082B060105050730018618687474703A" +
862+
"2F2F6F6373702E64696769636572742E636F6D304E06082B0601050507300286" +
863+
"42687474703A2F2F636163657274732E64696769636572742E636F6D2F446967" +
864+
"694365727453484132417373757265644944436F64655369676E696E6743412E" +
865+
"637274300C0603551D130101FF04023000300D06092A864886F70D01010B0500" +
866+
"038201010045B9D9868E494BD02635D0E42DDE80B37A865C389CFDD99BFC9B62" +
867+
"E2C169A73B5EABF282607439EFF5C61630886DEB63415B53683446A73041686C" +
868+
"326BA35FF0029FEF603D7C80FA0177A4DE35013529B01F759FD5041479BDBB6B" +
869+
"93B18144CB14E431BC144146848EF8ADB0E28952EAD1BB49E8547FFE99348170" +
870+
"36338B20C4E0B9D7C6A4E5BE3D57157F21904A5C864946313EA6B7D950EE0235" +
871+
"B5D2CD01490AD2B2A1AB5F66EC8986D64A1D9D239C131E09E5CA1C02A75F2D7E" +
872+
"C07E4C858856A6A58AB94DEAC8B3D3A5BBF492EE2463B156E6A0660BB452E359" +
873+
"22D00456F0DEE0ED15A8BF8FFF31008756B14EEE0AC14BCF19A3CD16819DC990" +
874+
"F5F45CDE21318201AE308201AA0201013081863072310B300906035504061302" +
875+
"555331153013060355040A130C446967694365727420496E6331193017060355" +
876+
"040B13107777772E64696769636572742E636F6D3131302F0603550403132844" +
877+
"696769436572742053484132204173737572656420494420436F646520536967" +
878+
"6E696E6720434102100D85090F3FACFF0A9008A12A9FB00A54300906052B0E03" +
879+
"021A0500300D06092A864886F70D01010B050004820100EAEEB9E1D4BFB979F1" +
880+
"A1C00EE1EC45069366CDD7489A0671F6DC9E3353F7FAEDCE7B87BD467ADFC850" +
881+
"877414966E7EB39C33367ABB03B3AA8BB1438BD952484CB807451499CAE8FDC9" +
882+
"527304D459D82CA039087560B5D3D0EA03DEA1B9472EFC44CBB55DD9A3C6A5C8" +
883+
"DFFD0786D5523F22604B412D6FC5A15E2D6285D7AB76EC216DE859391D129D51" +
884+
"6C27348EDAE7DC43335D12242D939CAF05385A118235F5B1E342EC034E70F655" +
885+
"793FF2FE037558EC2F45BD2683704F8FFD49B910131F4F2804B4282C5C36E41C" +
886+
"9E4E4F93446D44E3106760D265C5C7A849CF03426ACCB294712E51313D5414A7" +
887+
"8227AB79F6B18E2A2054E3FA781DAA2998EB33EDDCDA80").HexToByteArray();
770888
}
771889
}

0 commit comments

Comments
 (0)