Skip to content

Replace SHA-1/RSA-1024 test data with SHA-256/RSA-2048 equivalents #131783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
joshuajyue wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Replace SHA-1/RSA-1024 test data with SHA-256/RSA-2048 equivalents #131783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions src/libraries/System.Security.Cryptography.Pkcs/tests/SignatureSupport.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,25 @@ public class SignatureSupport
public static bool SupportsRsaSha1Signatures { get; } =
System.Security.Cryptography.Tests.SignatureSupport.CanProduceSha1Signature(RSA.Create());

public static bool SupportsEcdsaSha1Signatures { get; } = GetSupportsEcdsaSha1Signatures();

public static bool SupportsRsaMd5Signatures { get; } =
System.Security.Cryptography.Tests.SignatureSupport.CanProduceMd5Signature(RSA.Create());

private static bool GetSupportsEcdsaSha1Signatures()
{
ECDsa ecdsa;

try
{
ecdsa = ECDsa.Create();
}
catch (PlatformNotSupportedException)
{
return false;
}

return System.Security.Cryptography.Tests.SignatureSupport.CanProduceSha1Signature(ecdsa);
}
}
}
33 changes: 19 additions & 14 deletions src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,11 +192,11 @@ public static void Ctor_NoContent_Throws()
() => new SignedCms(SubjectIdentifierType.SubjectKeyIdentifier, null, true));
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void CheckSignature_ExtraStore_IsAdditional()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.RsaPkcs1OneSignerIssuerAndSerialNumber);
cms.Decode(SignedDocuments.RsaPkcs1Sha256OneSignerIssuerAndSerialNumber);

// Assert.NotThrows
cms.CheckSignature(true);
Expand All @@ -205,10 +205,10 @@ public static void CheckSignature_ExtraStore_IsAdditional()
cms.CheckSignature(new X509Certificate2Collection(), true);
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void Decode_IgnoresExtraData()
{
byte[] basis = SignedDocuments.RsaPkcs1OneSignerIssuerAndSerialNumber;
byte[] basis = SignedDocuments.RsaPkcs1Sha256OneSignerIssuerAndSerialNumber;
byte[] data = new byte[basis.Length + 60];
data.AsSpan(basis.Length).Fill(0x5E);
basis.AsSpan().CopyTo(data);
Expand Down Expand Up @@ -1233,11 +1233,11 @@ public static void EnsureExtraCertsAdded(bool newDocument)
cms.CheckSignature(true);
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void UntrustedCertFails_WhenTrustChecked()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.RsaPkcs1OneSignerIssuerAndSerialNumber);
cms.Decode(SignedDocuments.RsaPkcs1Sha256OneSignerIssuerAndSerialNumber);

// Assert.NoThrow
cms.CheckSignature(true);
Expand Down Expand Up @@ -1542,20 +1542,22 @@ public static void SignIdentifiedContent_BadOid(string? oidValueIn, string conte
Assert.Equal(contentHex, signedCms.ContentInfo.Content.ByteArrayToHex());
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void CheckSignedEncrypted_IssuerSerial_FromNetFx()
{
CheckSignedEncrypted(
SignedDocuments.SignedCmsOverEnvelopedCms_IssuerSerial_NetFx,
SubjectIdentifierType.IssuerAndSerialNumber);
SignedDocuments.SignedCmsOverEnvelopedCms_IssuerSerial_Sha256_NetFx,
SubjectIdentifierType.IssuerAndSerialNumber,
Certificates.RSA2048Sha256KeyTransfer1);
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void CheckSignedEncrypted_SKID_FromNetFx()
{
CheckSignedEncrypted(
SignedDocuments.SignedCmsOverEnvelopedCms_SKID_NetFx,
SubjectIdentifierType.SubjectKeyIdentifier);
SignedDocuments.SignedCmsOverEnvelopedCms_SKID_Sha256_NetFx,
SubjectIdentifierType.SubjectKeyIdentifier,
Certificates.RSA2048Sha256KeyTransfer1);
}

[Fact]
Expand Down Expand Up @@ -1590,7 +1592,10 @@ public static void ReadAndWriteDocumentWithIndefiniteLengthContent(bool checkSig
cms.Encode();
}

private static void CheckSignedEncrypted(byte[] docBytes, SubjectIdentifierType expectedType)
private static void CheckSignedEncrypted(
byte[] docBytes,
SubjectIdentifierType expectedType,
CertLoader? decryptionCert = null)
{
SignedCms signedCms = new SignedCms();
signedCms.Decode(docBytes);
Expand All @@ -1607,7 +1612,7 @@ private static void CheckSignedEncrypted(byte[] docBytes, SubjectIdentifierType
EnvelopedCms envelopedCms = new EnvelopedCms();
envelopedCms.Decode(signedCms.ContentInfo.Content);

using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.TryGetCertificateWithPrivateKey())
using (X509Certificate2 cert = (decryptionCert ?? Certificates.RSAKeyTransferCapi1).TryGetCertificateWithPrivateKey())
{
envelopedCms.Decrypt(new X509Certificate2Collection(cert));
}
Expand Down
12 changes: 6 additions & 6 deletions src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,11 +403,11 @@ public static void SignCmsUsingSlhDsaCertWithNotMatchingKeyThrows()
}
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void AddCertificate()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1OneSigner);
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1Sha256OneSigner);

int numOfCerts = cms.Certificates.Count;

Expand All @@ -422,11 +422,11 @@ public static void AddCertificate()
}
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void AddCertificateWithPrivateKey()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1OneSigner);
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1Sha256OneSigner);

int numOfCerts = cms.Certificates.Count;

Expand Down Expand Up @@ -487,11 +487,11 @@ public static void RemoveNonExistingCertificate()
}
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void RemoveAllCertsAddBackSignerCert()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1OneSigner);
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1Sha256OneSigner);

SignerInfo signerInfoBeforeRemoval = cms.SignerInfos[0];
X509Certificate2 signerCert = signerInfoBeforeRemoval.Certificate;
Expand Down
104 changes: 62 additions & 42 deletions ...ibraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsWholeDocumentTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,12 +137,12 @@ public static void ReadRsaPssDocument(bool fromSpan)
Assert.Throws<CryptographicException>(() => cms.CheckSignature(true));
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void ReadRsaPkcs1SimpleDocument()
{
SignedCms cms = new SignedCms();

cms.Decode(SignedDocuments.RsaPkcs1OneSignerIssuerAndSerialNumber);
cms.Decode(SignedDocuments.RsaPkcs1Sha256OneSignerIssuerAndSerialNumber);

Assert.Equal(1, cms.Version);

Expand All @@ -155,7 +155,7 @@ public static void ReadRsaPkcs1SimpleDocument()
Assert.Single(signers);
SignerInfo signer = signers[0];

using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.GetCertificate())
using (X509Certificate2 cert = Certificates.RSA2048Sha256KeyTransfer1.GetCertificate())
{
X509Certificate2Collection certs = cms.Certificates;

Expand All @@ -169,16 +169,20 @@ public static void ReadRsaPkcs1SimpleDocument()
}

Assert.Equal(SubjectIdentifierType.IssuerAndSerialNumber, signer.SignerIdentifier.Type);
Assert.Equal(Oids.Sha1, signer.DigestAlgorithm.Value);
Assert.Equal(Oids.Sha256, signer.DigestAlgorithm.Value);

#if NET
Assert.Equal(Oids.Rsa, signer.SignatureAlgorithm.Value);

Assert.Equal(
"5A1717621D450130B3463662160EEC06F7AE77E017DD95F294E97A0BDD433FE6" +
"B2CCB34FAAC33AEA50BFD7D9E78DC7174836284619F744278AE77B8495091E09" +
"6EEF682D9CA95F6E81C7DDCEDDA6A12316B453C894B5000701EB09DF57A53B73" +
"3A4E80DA27FA710870BD88C86E2FDB9DCA14D18BEB2F0C87E9632ABF02BE2FE3",
"3CD3B859C9F718DE62016F261AC540CFCD81B9B17A5AA8574E4677FBEF6F5827" +
"ECEDA9783F744F971398D361231D33CAACFEFD20C3AFE8D59A523E4E6ECCBD96" +
"6955CB3BE8ED36B6F78D541E97F241FA15A5F08D25C8F19B58DF6B7CD6952AA4" +
"790AB1A590D65DBAF443F378F360792ECB719C9B8EF85C0D274C00C1BBCD9274" +
"E31D071F9F7C9A6CD2AFE224EE1339844DF8CE736C91559B9DE8B536069E0749" +
"D4DE67C9A88B243DFDB31CE383948C5323CCC42B7D9CE0D897A2F68DC134BB28" +
"661E2A41B8C9FED8FD7209EAC81E658B93473B1588A00A5E3FD8076229B4C769" +
"B4CCFD96790DB2378495BA17974E49BE6434AF34B22F7EB9F0B510F4AC8D51B5",
signer.GetSignature().ByteArrayToHex());
#endif

Expand All @@ -205,12 +209,12 @@ public static void ReadRsaPkcs1SimpleDocument()
cms.CheckSignature(true);
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void ReadRsaPkcs1CounterSigned()
{
SignedCms cms = new SignedCms();

cms.Decode(SignedDocuments.CounterSignedRsaPkcs1OneSigner);
cms.Decode(SignedDocuments.CounterSignedRsaPkcs1Sha256OneSigner);

Assert.Equal(1, cms.Version);

Expand All @@ -222,7 +226,7 @@ public static void ReadRsaPkcs1CounterSigned()
Assert.Single(signers);
SignerInfo signer = signers[0];

using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.GetCertificate())
using (X509Certificate2 cert = Certificates.RSA2048Sha256KeyTransfer1.GetCertificate())
{
X509Certificate2Collection certs = cms.Certificates;

Expand All @@ -236,16 +240,20 @@ public static void ReadRsaPkcs1CounterSigned()
}

Assert.Equal(SubjectIdentifierType.IssuerAndSerialNumber, signer.SignerIdentifier.Type);
Assert.Equal(Oids.Sha1, signer.DigestAlgorithm.Value);
Assert.Equal(Oids.Sha256, signer.DigestAlgorithm.Value);

#if NET
Assert.Equal(Oids.Rsa, signer.SignatureAlgorithm.Value);

Assert.Equal(
"5A1717621D450130B3463662160EEC06F7AE77E017DD95F294E97A0BDD433FE6" +
"B2CCB34FAAC33AEA50BFD7D9E78DC7174836284619F744278AE77B8495091E09" +
"6EEF682D9CA95F6E81C7DDCEDDA6A12316B453C894B5000701EB09DF57A53B73" +
"3A4E80DA27FA710870BD88C86E2FDB9DCA14D18BEB2F0C87E9632ABF02BE2FE3",
"3CD3B859C9F718DE62016F261AC540CFCD81B9B17A5AA8574E4677FBEF6F5827" +
"ECEDA9783F744F971398D361231D33CAACFEFD20C3AFE8D59A523E4E6ECCBD96" +
"6955CB3BE8ED36B6F78D541E97F241FA15A5F08D25C8F19B58DF6B7CD6952AA4" +
"790AB1A590D65DBAF443F378F360792ECB719C9B8EF85C0D274C00C1BBCD9274" +
"E31D071F9F7C9A6CD2AFE224EE1339844DF8CE736C91559B9DE8B536069E0749" +
"D4DE67C9A88B243DFDB31CE383948C5323CCC42B7D9CE0D897A2F68DC134BB28" +
"661E2A41B8C9FED8FD7209EAC81E658B93473B1588A00A5E3FD8076229B4C769" +
"B4CCFD96790DB2378495BA17974E49BE6434AF34B22F7EB9F0B510F4AC8D51B5",
signer.GetSignature().ByteArrayToHex());
#endif

Expand Down Expand Up @@ -406,11 +414,11 @@ public static void CheckNoSignatureDocument()
Assert.Throws<CryptographicException>(() => cms.CheckSignature(true));
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void NonEmbeddedCertificate()
{
SignedCms cms = new SignedCms();
cms.Decode(SignedDocuments.RsaCapiTransfer1_NoEmbeddedCert);
cms.Decode(SignedDocuments.RsaSha256Transfer1_NoEmbeddedCert);

Assert.Equal(3, cms.Version);
Assert.Equal(Oids.Pkcs7Data, cms.ContentInfo.ContentType.Value);
Expand All @@ -427,8 +435,8 @@ public static void NonEmbeddedCertificate()
SignerInfo signer = signers[0];
Assert.Equal(3, signer.Version);
Assert.Equal(SubjectIdentifierType.SubjectKeyIdentifier, signer.SignerIdentifier.Type);
Assert.Equal("6B4A6B92FDED07EE0119F3674A96D1A70D2A588D", (string)signer.SignerIdentifier.Value);
Assert.Equal(Oids.Sha1, signer.DigestAlgorithm.Value);
Assert.Equal("FEDFD2558B95E705584A50008ED0D1683AEE840E", (string)signer.SignerIdentifier.Value);
Assert.Equal(Oids.Sha256, signer.DigestAlgorithm.Value);

CryptographicAttributeObjectCollection signedAttrs = signer.SignedAttributes;
Assert.Equal(3, signedAttrs.Count);
Expand All @@ -452,17 +460,21 @@ public static void NonEmbeddedCertificate()
Assert.Equal(Oids.Rsa, signer.SignatureAlgorithm.Value);

Assert.Equal(
"0EDE3870B8A80B45A21BAEC4681D059B46502E1B1AA6B8920CF50D4D837646A5" +
"5559B4C05849126C655D95FF3C6C1B420E07DC42629F294EE69822FEA56F32D4" +
"1B824CBB6BF809B7583C27E77B7AC58DFC925B1C60EA4A67AA84D73FC9E9191D" +
"33B36645F17FD6748A2D8B12C6C384C3C734D27273386211E4518FE2B4ED0147",
"4C05163F2F1C0B9E1C8FD1F43C8D9153EF8E8AF0C8B14E573DDE5281C7E6EF8C" +
"BBDCB10F5FF57C1FF8AF6177AAE8A11B4E3E4B4A32205FA69EBA3A3F54FE0800" +
"DE31D92FF7529F60778FBD3D8C2E3065FEA481C4A2BFF7A5AFBF9B1621652D61" +
"B999D9458A85286C04AEFF2C2A438CB74C722D416B026B9D9DF549C1A75A8D28" +
"2542FC34A673CD439DEF4E0B831C4A32C9DB16DBC365665CB6113A1586170876" +
"4F32D9693E8103693A5A0121B0E9F8436B6F1946B15FC1B8A1D0922D11D0424E" +
"6D32196D56E3F65F8DD97568539362084A19545D3F291DC7FB4EAE1ECE67E428" +
"0995C8FBBFD5BD25E1A03C6F03AB1B985DBBA3D707878EB5591ED39EFB432DBD",
signer.GetSignature().ByteArrayToHex());
#endif

using (SHA1 sha1 = SHA1.Create())
using (SHA256 sha256 = SHA256.Create())
{
Assert.Equal(
sha1.ComputeHash(cms.ContentInfo.Content).ByteArrayToHex(),
sha256.ComputeHash(cms.ContentInfo.Content).ByteArrayToHex(),
messageDigest.MessageDigest.ByteArrayToHex());
}

Expand All @@ -479,7 +491,7 @@ public static void NonEmbeddedCertificate()
Assert.Throws<CryptographicException>(() => cms.CheckSignature(true));

using (X509Certificate2 wrongCert = Certificates.RSAKeyTransfer1.GetCertificate())
using (X509Certificate2 rightCert = Certificates.RSAKeyTransferCapi1.GetCertificate())
using (X509Certificate2 rightCert = Certificates.RSA2048Sha256KeyTransfer1.GetCertificate())
{
X509Certificate2Collection coll = new X509Certificate2Collection(wrongCert);

Expand Down Expand Up @@ -519,12 +531,12 @@ public static void NonEmbeddedCertificate()
}
}

[ConditionalFact(typeof(SignatureSupport), nameof(SignatureSupport.SupportsRsaSha1Signatures))]
[Fact]
public static void ReadRsaPkcs1DoubleCounterSigned()
{
SignedCms cms = new SignedCms();

cms.Decode(SignedDocuments.OneRsaSignerTwoRsaCounterSigners);
cms.Decode(SignedDocuments.OneRsaSignerTwoRsaCounterSigners_Sha256);

Assert.Equal(1, cms.Version);

Expand All @@ -536,30 +548,34 @@ public static void ReadRsaPkcs1DoubleCounterSigned()
Assert.Single(signers);
SignerInfo signer = signers[0];

using (X509Certificate2 cert = Certificates.RSAKeyTransferCapi1.GetCertificate())
using (X509Certificate2 cert = Certificates.RSA2048Sha256KeyTransfer1.GetCertificate())
{
X509Certificate2Collection certs = cms.Certificates;

Assert.Equal(2, certs.Count);

Assert.Equal(cert, certs[1]);
Assert.Equal(cert, certs[0]);
Assert.Equal(cert, signer.Certificate);
Assert.NotSame(certs[1], signer.Certificate);
Assert.NotSame(certs[0], signer.Certificate);
Assert.NotSame(cert, signer.Certificate);
Assert.NotSame(cert, certs[1]);
Assert.NotSame(cert, certs[0]);
}

Assert.Equal(SubjectIdentifierType.IssuerAndSerialNumber, signer.SignerIdentifier.Type);
Assert.Equal(Oids.Sha1, signer.DigestAlgorithm.Value);
Assert.Equal(Oids.Sha256, signer.DigestAlgorithm.Value);

#if NET
Assert.Equal(Oids.Rsa, signer.SignatureAlgorithm.Value);

Assert.Equal(
"5A1717621D450130B3463662160EEC06F7AE77E017DD95F294E97A0BDD433FE6" +
"B2CCB34FAAC33AEA50BFD7D9E78DC7174836284619F744278AE77B8495091E09" +
"6EEF682D9CA95F6E81C7DDCEDDA6A12316B453C894B5000701EB09DF57A53B73" +
"3A4E80DA27FA710870BD88C86E2FDB9DCA14D18BEB2F0C87E9632ABF02BE2FE3",
"3CD3B859C9F718DE62016F261AC540CFCD81B9B17A5AA8574E4677FBEF6F5827" +
"ECEDA9783F744F971398D361231D33CAACFEFD20C3AFE8D59A523E4E6ECCBD96" +
"6955CB3BE8ED36B6F78D541E97F241FA15A5F08D25C8F19B58DF6B7CD6952AA4" +
"790AB1A590D65DBAF443F378F360792ECB719C9B8EF85C0D274C00C1BBCD9274" +
"E31D071F9F7C9A6CD2AFE224EE1339844DF8CE736C91559B9DE8B536069E0749" +
"D4DE67C9A88B243DFDB31CE383948C5323CCC42B7D9CE0D897A2F68DC134BB28" +
"661E2A41B8C9FED8FD7209EAC81E658B93473B1588A00A5E3FD8076229B4C769" +
"B4CCFD96790DB2378495BA17974E49BE6434AF34B22F7EB9F0B510F4AC8D51B5",
signer.GetSignature().ByteArrayToHex());
#endif

Expand Down Expand Up @@ -600,10 +616,14 @@ public static void ReadRsaPkcs1DoubleCounterSigned()

#if NET
Assert.Equal(
"1AA282DBED4D862D7CEA30F803E790BDB0C97EE852778CEEDDCD94BB9304A155" +
"2E60A8D36052AC8C2D28755F3B2F473824100AB3A6ABD4C15ABD77E0FFE13D0D" +
"F253BCD99C718FA673B6CB0CBBC68CE5A4AC671298C0A07C7223522E0E7FFF15" +
"CEDBAB55AAA99588517674671691065EB083FB729D1E9C04B2BF99A9953DAA5E",
"62A4F60AA0E6D85245F5224EE11B7A20F2353B7ECA5FCA50721CDF692B39A359" +
"1274CB542CB173288C1D9545F43B76FF04BFACE110B288FBD3D017E6F147F6F4" +
"E0E07D93618F8AF6A32049CF4D1ADD9E9663961B8F1C8D2BEA8886E9AE0B1747" +
"B25472BF885C0AB089BD020184D5C8D73143A4E4A37AD1564F960482769B336D" +
"04AF11930719DAED52C38DF4860CA294B45D748E53E206A1191D355D32591B3B" +
"614FB48E8F610E19B4D367D1959E609C216AE31B2F5B1890196A21006D1BEFAA" +
"756DD26675BB0E63F4DD89F3BB65B649D740F2C05C95A985BD0B4D81C5E40C49" +
"AA88E1A65899275298D159F2035446874438561621E4B1F89EAADC7004C45C32",
cs2.GetSignature().ByteArrayToHex());
#endif

Expand Down
Loading