Bugzilla.mozilla 1409867 org.mozilla.jss.pkix.cms.SignerInfo incorrectly producing signatures (especially for EC)
authorDavid Stutzman david.konrad.stutzman@us.army.mil
Thu, 26 Oct 2017 16:59:06 -0700
changeset 2207 b1a3c3cc6b3584948d251d3bfcfe6630d8970db5
parent 2206 252c10f448971b7ae087bde259505abd5dc5a03a
child 2208 19a0e2146a929173757e6ccbb61a035ec9426f43
push id78
push usercfu@redhat.com
push dateFri, 27 Oct 2017 00:01:14 +0000
bugs1409867, 113549
Bugzilla.mozilla 1409867 org.mozilla.jss.pkix.cms.SignerInfo incorrectly producing signatures (especially for EC) The patch fixes the OID that goes into the signatureAlgorithm field as well as passing the full signature algorithm to the Signature context to generate the signature using the proper algorithm. With this patch, if one passes SignatureAlgorithm.RSASignatureWithSHA256Digest in the constructor one will now get sha256WithRSAEncryption (1 2 840 113549 1 1 11) in the signatureAlgorithm field. cfu checking in for dstutzman
org/mozilla/jss/pkix/cms/SignerInfo.java
--- a/org/mozilla/jss/pkix/cms/SignerInfo.java
+++ b/org/mozilla/jss/pkix/cms/SignerInfo.java
@@ -284,17 +284,17 @@ public class SignerInfo implements ASN1V
             Attribute attrib = new Attribute(CONTENT_TYPE, contentType);
             signedAttributes.addElement(attrib);
             attrib = new Attribute(MESSAGE_DIGEST,
                             new OCTET_STRING(messageDigest) );
             signedAttributes.addElement(attrib);
         }
 
         digestEncryptionAlgorithm = new AlgorithmIdentifier(
-            signingAlg.getRawAlg().toOID(),null );
+            signingAlg.toOID(),null );
 
 
         if( signedAttributes != null ) 
         {
             Assert._assert( signedAttributes.size() >= 2 );
             this.signedAttributes = signedAttributes;
         }
 
@@ -327,17 +327,17 @@ public class SignerInfo implements ASN1V
             toBeSigned = ASN1Util.encode(digestInfo);
         } else {
             toBeSigned = digest;
         }
         
         // encrypt the DER-encoded DigestInfo with the private key
         CryptoToken token = signingKey.getOwningToken();
         Signature sig;
-        sig = token.getSignatureContext( signingAlg.getRawAlg() );
+        sig = token.getSignatureContext( signingAlg );
         sig.initSign(signingKey);
         sig.update(toBeSigned);
         encryptedDigest = new OCTET_STRING(sig.sign());
 
         if( unsignedAttributes != null )
         {
             this.unsignedAttributes = unsignedAttributes;
         }