pkcs7: add RSA-PSS support for SignedData #9742
Open
+932
−141
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
6 times, most recently
from
c4749c5 to
38bcb07
Compare
Contributor
Author
|
retest this please |
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
15 times, most recently
from
38c50b5 to
a4ff167
Compare
Add full RSA-PSS (RSASSA-PSS) support to PKCS#7 SignedData encoding and verification. This change enables SignerInfo.signatureAlgorithm to use id-RSASSA-PSS with explicit RSASSA-PSS-params (hash, MGF1, salt length), as required by RFC 4055 and CMS profiles. Key changes: - Add RSA-PSS encode and verify paths for PKCS7 SignedData - Encode full RSASSA-PSS AlgorithmIdentifier parameters - Decode RSA-PSS parameters from SignerInfo for verification - Treat RSA-PSS like ECDSA (sign raw digest, not DigestInfo) - Fix certificate signatureAlgorithm parameter length handling - Add API test coverage for RSA-PSS SignedData This resolves failures when using RSA-PSS signer certificates (e.g. -173 invalid signature algorithm) and maintains backward compatibility with RSA PKCS#1 v1.5 and ECDSA. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
from
a4ff167 to
2f8e307
Compare
Contributor
Author
|
retest this please |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add full RSA-PSS (RSASSA-PSS) support to PKCS#7 SignedData encoding and verification.
This change enables
SignerInfo.signatureAlgorithmto use id-RSASSA-PSS with explicit RSASSA-PSS-params (hash, MGF1, salt length), as required by RFC 4055 and CMS profiles.Key changes:
This resolves failures when using RSA-PSS signer certificates (e.g. -173 invalid signature algorithm) and maintains backward compatibility with RSA PKCS#1 v1.5 and ECDSA.
Testing
test_wc_PKCS7_EncodeSignedData_RSA_PSS(guarded byHAVE_PKCS7,WC_RSA_PSS, RSA, filesystem, SHA-256). Usescerts/rsapss/client-rsapss.derandclient-rsapss-priv.der; encodes SignedData and optionally round-trip verifies.os-check.ymlupdated with build--enable-pkcs7 CPPFLAGS=-DWC_RSA_PSS.Checklist