This repository has been archived by the owner on Oct 5, 2021. It is now read-only.
protocol: Allow for PKCS #7 backwards compatibility #22
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Depends on #23 (to fix the CI)
Many signature protocols use a format that is technically backwards
compatible with CMS. However, these incompatibilities are minor and can
be avoided by removing the check for
octets.Tag == asn1.TagOctetString
.By just returning the octets.Bytes without checking the tag, old-style
PKCS #7 signatures can now be created and verified without issue.
I tested this with Microsoft Authenticode Signatures (which use non-CMS PKCS7), both creating and verifying. Note that verifying non-standard structures also requires #21 (to call
sd.psd.EncapContentInfo.EContentValue
on acms.SignedData
).@mastahyeti how would you like me to add test cases here?
EDIT: Note that this procedure of not requiring the
OCTET STRING
to keep backwards compatiblity with PKCS7 is described in the CMS RFC, RFC 5652 Section 5.2.1: