crypto/default/cms/verify_signature.cc

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "crypto/default/cms/verify_signature.h"

#include <stddef.h>
#include <stdint.h>

#include <memory>
#include <string>
#include <vector>

#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/str_cat.h"
#include "absl/strings/str_format.h"
#include "absl/strings/string_view.h"
#include "crypto/default/cms/cms_parser.h"
#include "crypto/default/cms/oids.h"
#include "openssl/asn1.h"
#include "openssl/base.h"
#include "openssl/bytestring.h"
#include "openssl/crypto.h"
#include "openssl/digest.h"
#include "openssl/err.h"
#include "openssl/evp.h"
#include "openssl/mem.h"
#include "openssl/nid.h"
#include "openssl/obj.h"
#include "openssl/obj_mac.h"
#include "openssl/objects.h"
#include "openssl/rsa.h"
#include "openssl/x509.h"

using absl::StatusCode;

namespace credentio_cms {
namespace {
// Append the OpenSSL error strings to the status message.
absl::Status OpenSslError(absl::StatusCode code,
                          absl::string_view error_message) {
  std::string message(error_message);
  const char *file, *data;
  int line, flags;
  while (uint32_t err = ERR_get_error_line_data(&file, &line, &data, &flags)) {
    if (file) {
      absl::StrAppendFormat(&message, "\n%s:%d ", file, line);
    } else {
      absl::StrAppend(&message, "\n");
    }

    if (const char* reason = ERR_reason_error_string(err)) {
      absl::StrAppend(&message, reason);
    } else {
      absl::StrAppend(&message, err);
    }

    if (data && (flags & ERR_TXT_STRING)) {
      absl::StrAppend(&message, " - ", data);
    }
  }
  return absl::Status(code, message);
}

// For PSS signatures, verify the parameters and apply them to 'pkey_ctx'.
// - 'certificate' is needed for the extra checks needed when a PSS
// certificate is used.
// - 'md' is the message digest algorithm used on the content (or signed
//   attributes), it will be used to initialize the masking function.
absl::Status SetPssParameters(const SignerInfo& signer, const X509& certificate,
                              int content_digest_nid, const EVP_MD* md,
                              EVP_PKEY_CTX* pkey_ctx) {
  // See https://tools.ietf.org/html/rfc4056 for the checks performed.
  const unsigned char* p =
      CBS_data(signer.signature_algorithm.parameter.cbs_ptr());
  if (p == nullptr ||
      CBS_len(signer.signature_algorithm.parameter.cbs_ptr()) == 0) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Missing PSS parameters");
  }
  bssl::UniquePtr<RSA_PSS_PARAMS> pss_params(d2i_RSA_PSS_PARAMS(
      nullptr, &p, CBS_len(&(signer.signature_algorithm.parameter).cbs())));
  if (pss_params == nullptr) {
    // http://tools.ietf.org/html/rfc4056#section-2.2
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Missing PSS parameters");
  }
  if (pss_params->trailerField &&
      ASN1_INTEGER_get(pss_params->trailerField) != 1) {
    return OpenSslError(absl::StatusCode::kUnimplemented,
                        "Unsupported PSS trailer value.");
  }
  if (X509_get_signature_nid(&certificate) == NID_rsassaPss) {
    return OpenSslError(
        absl::StatusCode::kUnimplemented,
        "PSS signatures are not supported with RSASSA-PSS certificates.");
  }
  if (EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING) != 1) {
    return OpenSslError(absl::StatusCode::kInternal,
                        "Failed to set PSS padding");
  }
  if (pss_params->hashAlgorithm) {
    // http://tools.ietf.org/html/rfc4056#section-3
    const ASN1_OBJECT* algorithm;
    X509_ALGOR_get0(&algorithm, /*out_param_type=*/nullptr,
                    /*out_param_value=*/nullptr, pss_params->hashAlgorithm);
    if (OBJ_obj2nid(algorithm) != content_digest_nid) {
      return absl::Status(
          absl::StatusCode::kInvalidArgument,
          "The PSS Hash algorithm doesn't match the content hash algorithm.");
    }
  }
  if (pss_params->maskGenAlgorithm) {
    const ASN1_OBJECT* algorithm;
    X509_ALGOR_get0(&algorithm, /*out_param_type=*/nullptr,
                    /*out_param_value=*/nullptr, pss_params->maskGenAlgorithm);
    if (OBJ_obj2nid(algorithm) != NID_mgf1) {
      return OpenSslError(absl::StatusCode::kUnimplemented,
                          "Unsupported PSS mask generation algorithm.");
    }
  }
  if (EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, md) != 1) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Failed to set the PSS MGF1 hash");
  }
  int salt_length = 20;
  if (pss_params->saltLength != nullptr) {
    salt_length = ASN1_INTEGER_get(pss_params->saltLength);
  }
  if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, salt_length) != 1) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Invalid PSS parameters");
  }
  return absl::OkStatus();
}

// Check that the hash of the 'contents' matches the digest present in the
// authenticated attributes.
absl::Status VerifySignedAttributesHash(const SignerInfo& signer,
                                        const std::vector<ByteString>& contents,
                                        int digest_nid) {
  const EVP_MD* md = EVP_get_digestbynid(digest_nid);
  if (md == nullptr) {
    return OpenSslError(absl::StatusCode::kUnimplemented,
                        "Failed to get the content hashing EVP_MD object.");
  }
  // When the authenticated attributes are present the signature is computed
  // over them so we need two checks:
  //   1) That the digest of the contents matches the attribute's
  //       message_digest.
  //   2) That the signature of the authenticated attributes is valid.
  bssl::ScopedEVP_MD_CTX md_context;
  if (!EVP_DigestInit_ex(md_context.get(), md, nullptr)) {
    return OpenSslError(absl::StatusCode::kInternal,
                        "EVP_DigestInit_ex failed.");
  }
  for (const auto& chunk : contents) {
    if (!EVP_DigestUpdate(md_context.get(), CBS_data(&(chunk).cbs()),
                          CBS_len(chunk.cbs_ptr()))) {
      return OpenSslError(absl::StatusCode::kInternal,
                          "EVP_DigestUpdate failed.");
    }
  }
  uint8_t md_value[EVP_MAX_MD_SIZE];
  unsigned md_len;
  if (!EVP_DigestFinal_ex(md_context.get(), md_value, &md_len)) {
    return OpenSslError(absl::StatusCode::kInternal,
                        "EVP_DigestFinal_ex failed.");
  }
  if (CBS_len(&(signer.message_digest).cbs()) != md_len ||
      CRYPTO_memcmp(md_value, CBS_data(&(signer.message_digest).cbs()),
                    CBS_len(&(signer.message_digest).cbs())) != 0) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Hash attribute mismatch");
  }
  return absl::OkStatus();
}

}  // namespace

absl::StatusOr<SignatureInfo> VerifySignature(
    const Content& cms_content, const SignerInfo& signer,
    const std::vector<ByteString>& contents, const X509& certificate) {
  ERR_clear_error();  // Clear OpenSSL's error queue for this thread.
  // Signed attributes checks, see
  // https://tools.ietf.org/html/rfc5652#section-5.6
  if (!CompareOid(cms_content.content_type.cbs(), kDataOid, sizeof(kDataOid)) &&
      CBS_len(signer.raw_signed_attributes.cbs_ptr()) == 0) {
    return absl::Status(absl::StatusCode::kInvalidArgument,
                        "The signed attributes are needed when the "
                        "encapsultated content type is not id-data.");
  }
  if (CBS_len(signer.raw_signed_attributes.cbs_ptr()) > 0) {
    if (CBS_len(signer.content_type_signed.cbs_ptr()) == 0 ||
        !CompareOid(signer.content_type_signed.cbs(),
                    cms_content.content_type.cbs())) {
      return absl::Status(absl::StatusCode::kInvalidArgument,
                          "Mismatch between the signed attributes content type "
                          "and the encapsultated content type.");
    }
    if (CBS_len(signer.message_digest.cbs_ptr()) == 0) {
      return absl::Status(absl::StatusCode::kInvalidArgument,
                          "Missing message digest in the signed attributes.");
    }
  }
  bssl::UniquePtr<EVP_PKEY> key(
      X509_get_pubkey(const_cast<X509*>(&certificate)));
  if (key == nullptr) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Failed to get the public key from the certificate.");
  }
  int digest_nid = OBJ_cbs2nid(&signer.digest_algorithm.algorithm_oid.cbs());
  if (digest_nid == NID_undef) {
    return OpenSslError(absl::StatusCode::kUnimplemented,
                        "Unknown digest algorithm.");
  }
  int signature_algorithm_nid =
      OBJ_cbs2nid(signer.signature_algorithm.algorithm_oid.cbs_ptr());
  // Get the digest NID from the signature NID if possible, otherwise use the
  // signer's digest algorithm.
  int signature_digest_nid = NID_undef;
  if (OBJ_find_sigid_algs(signature_algorithm_nid, &signature_digest_nid,
                          nullptr /* pkey nid */) != 1 ||
      signature_digest_nid == NID_undef) {
    signature_digest_nid = digest_nid;
  }

  // Check that the signature algorithm is supported.
  switch (signature_algorithm_nid) {
    case NID_rsassaPss:
    case NID_rsaEncryption:
    case NID_sha224WithRSAEncryption:
    case NID_sha256WithRSAEncryption:
    case NID_sha384WithRSAEncryption:
    case NID_sha512WithRSAEncryption:
    case NID_X9_62_id_ecPublicKey:
      break;

    // ECDSA support is defined in RFC 5753 and includes instructions for
    // additional verification that `digest_nid` must match the value derived
    // from `signature_algorithm_nid`. (See RFC 5753 section 2.1.1.) Note
    // that the RFC permits the use of SHA-1 for ECDSA signatures, but we do
    // not, as at the time of writing it had long been obsolete.
    case NID_ecdsa_with_SHA224:
    case NID_ecdsa_with_SHA256:
    case NID_ecdsa_with_SHA384:
    case NID_ecdsa_with_SHA512:
      if (digest_nid != signature_digest_nid) {
        return absl::InvalidArgumentError(absl::StrFormat(
            R"(The digest algorithm does not match the value derived from the signature algorithm: digest_nid=%d, signature_digest_nid=%d)",
            digest_nid, signature_digest_nid));
      }
      break;

    default:
      return OpenSslError(
          absl::StatusCode::kUnimplemented,
          absl::StrCat("Signature algorithm not implemented, NID: ",
                       signature_algorithm_nid));
  }

  const EVP_MD* signature_md = EVP_get_digestbynid(signature_digest_nid);
  if (signature_md == nullptr) {
    return OpenSslError(absl::StatusCode::kUnimplemented,
                        "Failed to get the signature EVP_MD object.");
  }
  bssl::ScopedEVP_MD_CTX md_context;
  EVP_PKEY_CTX* pkey_ctx = nullptr;
  if (EVP_DigestVerifyInit(md_context.get(), &pkey_ctx, signature_md,
                           nullptr /* engine */, key.get()) != 1) {
    return OpenSslError(absl::StatusCode::kInternal,
                        "EVP_DigestVerifyInit failed.");
  }
  if (signature_algorithm_nid == NID_rsassaPss) {
    auto status = SetPssParameters(signer, certificate, digest_nid,
                                   signature_md, pkey_ctx);
    if (!status.ok()) {
      return status;
    }
  }

  if (CBS_len(signer.raw_signed_attributes.cbs_ptr()) > 0) {
    auto status = VerifySignedAttributesHash(signer, contents, digest_nid);
    if (!status.ok()) {
      return status;
    }
    // The signature is computed after replacing the implicit tag.
    // https://tools.ietf.org/html/rfc2315#section-9.3
    uint8_t tag = 0x31;  // SET
    if (EVP_DigestVerifyUpdate(md_context.get(), &tag, 1) != 1 ||
        EVP_DigestVerifyUpdate(
            md_context.get(),
            reinterpret_cast<const char*>(
                CBS_data(signer.raw_signed_attributes.cbs_ptr()) + 1),
            CBS_len(signer.raw_signed_attributes.cbs_ptr()) - 1) != 1) {
      return OpenSslError(absl::StatusCode::kInternal,
                          "EVP_DigestVerifyUpdate failed.");
    }
  } else {
    // When there are no authenticated attributes the signature is computed on
    // the contents.
    for (const auto& chunk : contents) {
      if (EVP_DigestVerifyUpdate(md_context.get(), CBS_data(chunk.cbs_ptr()),
                                 CBS_len(chunk.cbs_ptr())) != 1) {
        return OpenSslError(absl::StatusCode::kInternal,
                            "EVP_DigestVerifyUpdate failed.");
      }
    }
  }
  if (EVP_DigestVerifyFinal(md_context.get(),
                            const_cast<unsigned char*>(
                                CBS_data(signer.signature_value.cbs_ptr())),
                            CBS_len(signer.signature_value.cbs_ptr())) != 1) {
    return OpenSslError(absl::StatusCode::kInvalidArgument,
                        "Invalid signature");
  }
  SignatureInfo signature_info;
  signature_info.digest_algorithm_nid = digest_nid;
  signature_info.signature_algorithm_id = signature_algorithm_nid;
  return signature_info;
}

}  // namespace credentio_cms