Skip to content

Authenticode-rs does not support signatures directly over the EmbeddedContent #237

@roblabla

Description

@roblabla

While investigating authenticode, I have come across a few edge cases that Windows reports as signed, that this library fails to parse. Here's one of them: a signature that doesn't use signed_attrs/Authenticated Attributes of the SignerInfo. Instead, the signature is done directly over the embedded content. Here's the sample: no_signed_attrs.exe.zip. And here's a sample of how the SignerInfo is generated (econtent_bytes is the EmbeddedContent serialized as DER):

SignerInfo {
    version: CmsVersion::V1,
    sid: SignerIdentifier::IssuerAndSerialNumber(isn_from_cert(end_cert)),
    digest_alg: digest_alg.ref_to_owned(),
    signed_attrs: None,
    signature_algorithm: ALG_RSA.ref_to_owned(),
    signature: OctetString::new(signing_key.sign(&econtent_bytes).to_vec()).unwrap(),
    unsigned_attrs: None,
}

When parsing with authenticode-rs, it fails with the following error: AttributeCertificateAuthenticodeError(InvalidSignature(EmptyAuthenticatedAttributes)).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions