crypto/default/cms/verify_signature.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_VERIFY_SIGNATURE_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_VERIFY_SIGNATURE_H_

#include <vector>

#include "absl/status/statusor.h"
#include "crypto/default/cms/cms_parser.h"
#include "openssl/obj_mac.h"
#include "openssl/ossl_typ.h"

namespace credentio_cms {
struct SignatureInfo {
  // OpenSSL NID for the digest algorithm.
  int digest_algorithm_nid = NID_undef;
  // OpenSSL id for the signature algorithm.
  int signature_algorithm_id = NID_undef;
};

// Verify a signature on the embedded content.
// The X509 certificate trustworthiness is not validated by this function.
// When the status is not OK the signature cannot be verified, the failure
// code returned is only intended for debugging purposes.
// The caller should also check that the digest and signature algorithms are
// reasonable (i.e. not MD5...)
absl::StatusOr<SignatureInfo> VerifySignature(
    const Content& cms_content, const SignerInfo& signer,
    const std::vector<ByteString>& contents, const X509& certificate);

}  // namespace credentio_cms

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_VERIFY_SIGNATURE_H_