What version of Go are you using (go version)?
go version go1.9 linux/amd64
Does this issue reproduce with the latest release?
Yes
The x509.Certificate's CheckSignature function does not truncate the signed data's hash (as dsa's docs say should be done), resulting in wrong check result. When I truncated the hash, the check passes, as can be seen below.
I'm not sure whether the hash should be truncated for all x509 certs. This is tested with Android APK signatures, which do require the truncation (the data in code below were extracted from this apk and there are more like it).
I can submit a pull request if you think it is correct to do the truncation.
Raw full source of the code (~4k lines)
package main
import (
"fmt"
"crypto/x509"
"crypto/sha256"
"crypto/dsa"
"math/big"
"errors"
"encoding/asn1"
)
type dsaSignature struct {
R, S *big.Int
}
func checkWithTruncatedHash(cert *x509.Certificate) error {
hash := sha256.Sum256(signed)
pub := cert.PublicKey.(*dsa.PublicKey)
reqLen := pub.Q.BitLen() / 8
if reqLen > len(hash) {
return fmt.Errorf("Digest algorithm is too short for given DSA parameters.")
}
digest := hash[:reqLen]
dsaSig := new(dsaSignature)
if rest, err := asn1.Unmarshal(signature, dsaSig); err != nil {
return err
} else if len(rest) != 0 {
return errors.New("x509: trailing data after DSA signature")
}
if dsaSig.R.Sign() <= 0 || dsaSig.S.Sign() <= 0 {
return errors.New("x509: DSA signature contained zero or negative values")
}
if !dsa.Verify(pub, digest, dsaSig.R, dsaSig.S) {
return errors.New("x509: DSA verification failure")
}
return nil
}
func main() {
cert, _ := x509.ParseCertificate(rawCert)
fmt.Printf("Result of check with original crypto/x509: %v\n", cert.CheckSignature(algo, signed, signature))
fmt.Printf("Result of check with truncated hash: %v\n", checkWithTruncatedHash(cert))
}
var algo = x509.DSAWithSHA256
var rawCert = []byte { ... }
var signature = []byte { ... }
var signed = []byte { ... }
What version of Go are you using (
go version)?go version go1.9 linux/amd64
Does this issue reproduce with the latest release?
Yes
The x509.Certificate's CheckSignature function does not truncate the signed data's hash (as dsa's docs say should be done), resulting in wrong check result. When I truncated the hash, the check passes, as can be seen below.
I'm not sure whether the hash should be truncated for all x509 certs. This is tested with Android APK signatures, which do require the truncation (the data in code below were extracted from this apk and there are more like it).
I can submit a pull request if you think it is correct to do the truncation.
Raw full source of the code (~4k lines)