Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Find encapsulated content hash in signed attributes by oid #9

Merged
merged 1 commit into from
Jan 3, 2025
Merged

Find encapsulated content hash in signed attributes by oid #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ require (
github.com/iden3/go-rapidsnark/types v0.0.3
github.com/iden3/go-rapidsnark/verifier v0.0.5
github.com/pkg/errors v0.9.1
github.com/rarimo/certificate-transparency-go v0.0.0-20240305114501-050b1f19639a
github.com/rarimo/certificate-transparency-go v0.0.0-20241028131422-3b57d6495419
github.com/rubenv/sql-migrate v1.6.1
github.com/stretchr/testify v1.8.4
gitlab.com/distributed_lab/ape v1.7.1
Expand Down Expand Up @@ -45,6 +45,7 @@ require (
github.com/getsentry/sentry-go v0.27.0 // indirect
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.1 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.0 // indirect
Expand Down Expand Up @@ -100,5 +101,6 @@ require (
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/klog/v2 v2.120.1 // indirect
rsc.io/tmplfunc v0.0.3 // indirect
)
6 changes: 6 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1427,6 +1427,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
github.com/go-ole/go-ole v1.2.1/go.mod h1:7FAglXiTm7HKlQRDeOQ6ZNUHidzCWXuZWq/1dTyBNF8=
github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
Expand Down Expand Up @@ -1990,6 +1992,8 @@ github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3c
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
github.com/rarimo/certificate-transparency-go v0.0.0-20240305114501-050b1f19639a h1:4PfCUdJ8IdegZj2LjFv5qJ8CzXaXTAqgNSJd34a86ac=
github.com/rarimo/certificate-transparency-go v0.0.0-20240305114501-050b1f19639a/go.mod h1:9WBW36Eaqp+++3u2TemGbVFqxe7Wpes4H7Ufomqn/DA=
github.com/rarimo/certificate-transparency-go v0.0.0-20241028131422-3b57d6495419 h1:SEDEM+NwYCHH0KkCiik/QiVb4TUJN9XlH6RdvKb1JwA=
github.com/rarimo/certificate-transparency-go v0.0.0-20241028131422-3b57d6495419/go.mod h1:9WBW36Eaqp+++3u2TemGbVFqxe7Wpes4H7Ufomqn/DA=
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
github.com/retailnext/hllpp v1.0.1-0.20180308014038-101a6d2f8b52/go.mod h1:RDpi1RftBQPUCDRw6SmxeaREsAaRKnOclghuzp/WRzc=
Expand Down Expand Up @@ -3103,6 +3107,8 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
Expand Down
75 changes: 48 additions & 27 deletions internal/service/api/handlers/register.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"encoding/asn1"
"encoding/hex"
"encoding/pem"
errors3 "errors"
"fmt"
"math/big"
"net/http"
Expand Down Expand Up @@ -414,44 +415,64 @@ func validateSignedAttributes(
return errors.New("signed attributes amount is 0")
}

digestAttr := types.DigestAttribute{}
if _, err := asn1.Unmarshal(signedAttributesASN1[len(signedAttributesASN1)-1].FullBytes, &digestAttr); err != nil {
return errors.Wrap(err, "failed to unmarshal ASN1")
}
allErr := make([]error, 0, 2)
// Some countries put encapsulated content hash in the middle of signed attr
// but the most put as last value, so we start from the end
for i := len(signedAttributesASN1) - 1; i >= 0; i-- {
digestAttr := types.DigestAttribute{}
if _, err := asn1.Unmarshal(signedAttributesASN1[i].FullBytes, &digestAttr); err != nil {
allErr = append(allErr, errors.Wrap(err, "failed to unmarshal ASN1"))
continue
}

if len(digestAttr.Digest) == 0 {
return errors.New("signed attributes digest values amount is 0")
}
if len(digestAttr.Digest) == 0 {
allErr = append(allErr, errors.New("signed attributes digest values amount is 0"))
continue
}

hashAlgorithmFromDigest := types.HashAlgorithmFromSize(len(digestAttr.Digest[0].Bytes))
if hashAlgorithm == nil {
fmt.Printf("passed hash algorithm is nil, using from signed attr: %s\n", hashAlgorithmFromDigest.String())
hashAlgorithm = &hashAlgorithmFromDigest
}
// we cannot hash some rubbish because it allows to pass illegal encapsulated content
if !digestAttr.ID.Equal(asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4}) {
allErr = append(allErr, errors.From(errors.New("field is not message digest"), logan.F{
"oid": digestAttr.ID,
}))
continue
}

if hashAlgorithmFromDigest != *hashAlgorithm {
// TODO use log
fmt.Printf("found different hash algorithm in signed attr %s\n", hashAlgorithmFromDigest.String())
if _, ok := types.IsValidHashAlgorithm(hashAlgorithmFromDigest.String()); ok {
fmt.Printf("changing hash algorithm from %s to %s\n", hashAlgorithm.String(), hashAlgorithmFromDigest.String())
*hashAlgorithm = hashAlgorithmFromDigest
maybeHash := digestAttr.Digest[0].Bytes
hashAlgorithmFromDigest := types.HashAlgorithmFromSize(len(maybeHash))
if hashAlgorithm == nil {
fmt.Printf("passed hash algorithm is nil, using from signed attr: %s\n", hashAlgorithmFromDigest.String())
artemskriabin marked this conversation as resolved.
Show resolved Hide resolved
hashAlgorithm = &hashAlgorithmFromDigest
}
}

h := types.GeneralHash(*hashAlgorithm)
h.Write(encapsulatedContent)
d := h.Sum(nil)
if hashAlgorithmFromDigest != *hashAlgorithm {
// TODO use log
fmt.Printf("found different hash algorithm in signed attr %s\n", hashAlgorithmFromDigest.String())
artemskriabin marked this conversation as resolved.
Show resolved Hide resolved
if _, ok := types.IsValidHashAlgorithm(hashAlgorithmFromDigest.String()); ok {
fmt.Printf("changing hash algorithm from %s to %s\n", hashAlgorithm.String(), hashAlgorithmFromDigest.String())
artemskriabin marked this conversation as resolved.
Show resolved Hide resolved
*hashAlgorithm = hashAlgorithmFromDigest
}
}

h := types.GeneralHash(*hashAlgorithm)
h.Write(encapsulatedContent)
d := h.Sum(nil)

if bytes.Equal(maybeHash, d) {
return nil
}

if !bytes.Equal(digestAttr.Digest[0].Bytes, d) {
return errors.From(
allErr = append(allErr, errors.From(
errors.New("digest values are not equal"), logan.F{
"signed_attributes": hex.EncodeToString(digestAttr.Digest[0].Bytes),
"maybe_hash": hex.EncodeToString(maybeHash),
"signed_attributes": hex.EncodeToString(signedAttributes),
"content_hash": hex.EncodeToString(d),
"encapsulated_content": hex.EncodeToString(encapsulatedContent),
},
)
))
}
return nil

return errors3.Join(allErr...)
}

func verifySignature(
Expand Down
Loading