Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Verify given signature validity #301

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Verify given signature validity #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/libelectronic-id
Open in desktop
Submodule libelectronic-id updated 13 files
+4 −0 CMakeLists.txt
+4 −2 include/electronic-id/electronic-id.hpp
+7 −0 include/electronic-id/enums.hpp
+15 −13 src/electronic-ids/ms-cryptoapi/MsCryptoApiElectronicID.cpp
+4 −2 src/electronic-ids/ms-cryptoapi/MsCryptoApiElectronicID.hpp
+15 −4 src/electronic-ids/pcsc/PcscElectronicID.hpp
+12 −2 src/electronic-ids/pkcs11/Pkcs11ElectronicID.cpp
+4 −2 src/electronic-ids/pkcs11/Pkcs11ElectronicID.hpp
+105 −7 src/electronic-ids/x509.hpp
+10 −70 tests/common/verify.hpp
+2 −3 tests/integration/test-authenticate.cpp
+1 −1 tests/integration/test-signing.cpp
+15 −10 tests/mock/test-get-certificate.cpp
11 changes: 6 additions & 5 deletions src/controller/command-handlers/authenticate.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,9 @@ QVariantMap createAuthenticationToken(const QString& signatureAlgorithm,
};
}

QByteArray createSignature(const QString& origin, const QString& challengeNonce,
const ElectronicID& eid, const pcsc_cpp::byte_vector& pin)
QByteArray createSignature(const QString& origin, const QByteArray& cert,
const QString& challengeNonce, const ElectronicID& eid,
const pcsc_cpp::byte_vector& pin)
{
static const std::map<JsonWebSignatureAlgorithm, QCryptographicHash::Algorithm>
SIGNATURE_ALGO_TO_HASH {
Expand Down Expand Up @@ -85,7 +86,7 @@ QByteArray createSignature(const QString& origin, const QString& challengeNonce,
const pcsc_cpp::byte_vector hashToBeSigned {hashToBeSignedQBytearray.cbegin(),
hashToBeSignedQBytearray.cend()};

const auto signature = eid.signWithAuthKey(pin, hashToBeSigned);
const auto signature = eid.signWithAuthKey({cert.cbegin(), cert.cend()}, pin, hashToBeSigned);

return QByteArray::fromRawData(reinterpret_cast<const char*>(signature.data()),
int(signature.size()))
Expand Down Expand Up @@ -125,8 +126,8 @@ QVariantMap Authenticate::onConfirm(WebEidUI* window,
auto pin = getPin(cardCertAndPin.cardInfo->eid().smartcard(), window);

try {
const auto signature =
createSignature(origin.url(), challengeNonce, cardCertAndPin.cardInfo->eid(), pin);
const auto signature = createSignature(origin.url(), cardCertAndPin.certificateBytesInDer,
challengeNonce, cardCertAndPin.cardInfo->eid(), pin);

// Erase the PIN memory.
// TODO: Use a scope guard. Verify that the buffers are actually zeroed and no copies
Expand Down
12 changes: 8 additions & 4 deletions src/controller/command-handlers/sign.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,13 @@ using namespace electronic_id;
namespace
{

QPair<QString, QVariantMap> signHash(const ElectronicID& eid, const pcsc_cpp::byte_vector& pin,
const QByteArray& docHash, const HashAlgorithm hashAlgo)
QPair<QString, QVariantMap> signHash(const ElectronicID& eid, const QByteArray& cert,
const pcsc_cpp::byte_vector& pin, const QByteArray& docHash,
const HashAlgorithm hashAlgo)
{
const auto hashBytes = pcsc_cpp::byte_vector {docHash.begin(), docHash.end()};
const auto signature = eid.signWithSigningKey(pin, hashBytes, hashAlgo);
const auto signature =
eid.signWithSigningKey({cert.cbegin(), cert.cend()}, pin, hashBytes, hashAlgo);

const auto signatureBase64 =
QByteArray::fromRawData(reinterpret_cast<const char*>(signature.first.data()),
Expand Down Expand Up @@ -98,7 +100,9 @@ QVariantMap Sign::onConfirm(WebEidUI* window, const CardCertificateAndPinInfo& c
auto pin = getPin(cardCertAndPin.cardInfo->eid().smartcard(), window);

try {
const auto signature = signHash(cardCertAndPin.cardInfo->eid(), pin, docHash, hashAlgo);
const auto signature =
signHash(cardCertAndPin.cardInfo->eid(), cardCertAndPin.certificateBytesInDer, pin,
docHash, hashAlgo);

// Erase PIN memory.
// TODO: Use a scope guard. Verify that the buffers are actually zeroed
Expand Down
Loading