Fix cross-platform strong name signing by manually parsing RSA key blobs

Author: Ahmed

src/Compiler/AbstractIL/ilsign.fs

@@ -1,4 +1,4 @@
-// Copyright (c) Microsoft Corporation.  All Rights Reserved.  See License.txt in the project root for license information.
+// Copyright (c) Microsoft Corporation.  All Rights Reserved.  See License.txt in the project root for license information.
 
 module internal FSharp.Compiler.AbstractIL.StrongNameSign
 
@@ -126,9 +126,11 @@ type BlobReader =
     val mutable _blob: byte array
     val mutable _offset: int
     new(blob: byte array) = { _blob = blob; _offset = 0 }
-    
-    member x.Offset with get() = x._offset and set(v) = x._offset <- v
-    
+
+    member x.Offset
+        with get () = x._offset
+        and set (v) = x._offset <- v
+
     member x.ReadInt32() : int =
         let offset = x._offset
         x._offset <- offset + 4
@@ -144,34 +146,40 @@ type BlobReader =
         x._offset <- x._offset + length
         arr |> Array.rev
 
-let RSAParametersFromBlob blob keyType =
+/// Decodes an RSA functional blob into RSAParameters.
+/// Ref: https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-publickeystruc
+let RSAParametersFromBlob blob =
     let mutable reader = BlobReader blob
 
-    let header = reader.ReadInt32()
-    if header <> 0x00000206 && header <> 0x00000207 && keyType = KeyType.KeyPair then
-        raise (CryptographicException(getResourceString (FSComp.SR.ilSignPrivateKeyExpected ())))
-
-    reader.ReadInt32() |> ignore // ALG_ID
+    // Skip PUBLICKEYSTRUC (8 bytes): bType(1), bVersion(1), reserved(2), aiKeyAlg(4)
+    reader.ReadInt32() |> ignore
+    reader.ReadInt32() |> ignore
 
-    if reader.ReadInt32() <> RSA_PRIV_MAGIC then
-        raise (CryptographicException(getResourceString (FSComp.SR.ilSignRsaKeyExpected ()))) // 'RSA2'
+    // Read RSAPUBKEY header (starts with magic)
+    // Ref: https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-rsapubkey
+    let magic = reader.ReadInt32()
 
-    let byteLen, halfLen =
-        let bitLen = reader.ReadInt32()
+    if magic <> RSA_PUB_MAGIC && magic <> RSA_PRIV_MAGIC then
+        raise (CryptographicException(getResourceString (FSComp.SR.ilSignRsaKeyExpected ())))
 
-        match bitLen % 16 with
-        | 0 -> (bitLen / 8, bitLen / 16)
-        | _ -> raise (CryptographicException(getResourceString (FSComp.SR.ilSignInvalidBitLen ())))
+    let bitLen = reader.ReadInt32()
+    let byteLen, halfLen = (bitLen / 8, bitLen / 16)
 
     let mutable key = RSAParameters()
-    key.Exponent <- reader.ReadBigInteger 4
+    key.Exponent <- reader.ReadBigInteger 4 // pubexp (4 bytes)
     key.Modulus <- reader.ReadBigInteger byteLen
-    key.P <- reader.ReadBigInteger halfLen
-    key.Q <- reader.ReadBigInteger halfLen
-    key.DP <- reader.ReadBigInteger halfLen
-    key.DQ <- reader.ReadBigInteger halfLen
-    key.InverseQ <- reader.ReadBigInteger halfLen
-    key.D <- reader.ReadBigInteger byteLen
+
+    // IMPORTANT: Conditional reading based on Magic.
+    // Private fields (P, Q, DP, DQ, InverseQ, D) follow the modulus ONLY in PrivateKeyBlobs (RSA2).
+    // Ref: https://learn.microsoft.com/en-us/windows/win32/seccrypto/base-provider-key-blobs
+    if magic = RSA_PRIV_MAGIC then
+        key.P <- reader.ReadBigInteger halfLen
+        key.Q <- reader.ReadBigInteger halfLen
+        key.DP <- reader.ReadBigInteger halfLen
+        key.DQ <- reader.ReadBigInteger halfLen
+        key.InverseQ <- reader.ReadBigInteger halfLen
+        key.D <- reader.ReadBigInteger byteLen
+
     key
 
 let validateRSAField (field: byte array MaybeNull) expected (name: string) =
@@ -262,13 +270,19 @@ let toCLRKeyBlob (rsaParameters: RSAParameters) (algId: int) : byte array =
 
     key
 
-let createSignature (hash: byte array) keyBlob keyType =
+let createSignature (hash: byte array) keyBlob _keyType =
     use rsa = RSA.Create()
-    rsa.ImportParameters(RSAParametersFromBlob keyBlob keyType)
+    rsa.ImportParameters(RSAParametersFromBlob keyBlob)
 
-    let signature =
-        rsa.SignHash(hash, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1)
+    let hashAlgName =
+        match hash.Length with
+        | 20 -> HashAlgorithmName.SHA1
+        | 32 -> HashAlgorithmName.SHA256
+        | 48 -> HashAlgorithmName.SHA384
+        | 64 -> HashAlgorithmName.SHA512
+        | _ -> HashAlgorithmName.SHA1
 
+    let signature = rsa.SignHash(hash, hashAlgName, RSASignaturePadding.Pkcs1)
     signature |> Array.rev
 
 let patchSignature (stream: Stream) (peReader: PEReader) (signature: byte array) =
@@ -304,29 +318,37 @@ let signStream stream keyBlob =
     patchSignature stream peReader signature
 
 let signatureSize (pk: byte array) =
-    if pk.Length < 20 then 0
+    if (box pk |> isNull) || pk.Length < 8 + 12 then
+        0
     else
-        let reader = BlobReader pk
-        reader.Offset <- 12
-        let bitLen = reader.ReadInt32()
-        let modulusLength = bitLen / 8
-        
-        if modulusLength < 160 then 128 else modulusLength - 32
-// Key signing
-type keyContainerName = string
-type keyPair = byte array
-type pubkey = byte array
-type pubkeyOptions = byte array * bool
+        let mutable reader = BlobReader pk
+        reader.Offset <- 8
+
+        let magic = reader.ReadInt32()
+
+        if magic = RSA_PUB_MAGIC || magic = RSA_PRIV_MAGIC then
+            let bitLen = reader.ReadInt32()
+            let size = bitLen / 8
+            (size + 7) &&& ~~~7
+        else
+            0
+
+let signatureSizeFromKeyPair (keyBlob: byte array) = signatureSize keyBlob
 
+// Returns a CLR Format Blob public key
 let getPublicKeyForKeyPair keyBlob =
     use rsa = RSA.Create()
-    rsa.ImportParameters(RSAParametersFromBlob keyBlob KeyType.KeyPair)
+    rsa.ImportParameters(RSAParametersFromBlob keyBlob)
     let rsaParameters = rsa.ExportParameters false
     toCLRKeyBlob rsaParameters CALG_RSA_KEYX
 
-let signerGetPublicKeyForKeyPair (kp: keyPair) : pubkey = getPublicKeyForKeyPair kp
+// Key signing
+type keyContainerName = string
+type keyPair = byte array
+type pubkey = byte array
+type pubkeyOptions = byte array * bool
 
-let signerSignatureSize (pk: pubkey) : int = signatureSize pk
+let signerGetPublicKeyForKeyPair (kp: keyPair) : pubkey = getPublicKeyForKeyPair kp
 
 let signerSignStreamWithKeyPair stream keyBlob = signStream stream keyBlob
 
@@ -345,37 +367,30 @@ type ILStrongNameSigner =
     static member OpenPublicKeyOptions kp p = PublicKeyOptionsSigner(kp, p)
 
     static member OpenPublicKey bytes = PublicKeySigner bytes
-    static member OpenKeyPairFile bytes = KeyPair(bytes)
+
+    static member OpenKeyPairFile bytes = KeyPair bytes
+
     static member OpenKeyContainer s = KeyContainer s
 
     member s.IsFullySigned =
         match s with
         | PublicKeySigner _ -> false
-        | PublicKeyOptionsSigner pko ->
-            let _, usePublicSign = pko
-            usePublicSign
+        | PublicKeyOptionsSigner(_, usePublicSign) -> usePublicSign
         | KeyPair _ -> true
         | KeyContainer _ -> failWithContainerSigningUnsupportedOnThisPlatform ()
 
     member s.PublicKey =
         match s with
         | PublicKeySigner pk -> pk
-        | PublicKeyOptionsSigner pko ->
-            let pk, _ = pko
-            pk
+        | PublicKeyOptionsSigner(pk, _) -> pk
         | KeyPair kp -> signerGetPublicKeyForKeyPair kp
         | KeyContainer _ -> failWithContainerSigningUnsupportedOnThisPlatform ()
 
     member s.SignatureSize =
-        let pkSignatureSize pk =
-            signerSignatureSize pk
-
         match s with
-        | PublicKeySigner pk -> pkSignatureSize pk
-        | PublicKeyOptionsSigner pko ->
-            let pk, _ = pko
-            pkSignatureSize pk
-        | KeyPair kp -> pkSignatureSize (signerGetPublicKeyForKeyPair kp)
+        | PublicKeySigner pk
+        | PublicKeyOptionsSigner(pk, _) -> signatureSize pk
+        | KeyPair kp -> signatureSize kp
         | KeyContainer _ -> failWithContainerSigningUnsupportedOnThisPlatform ()
 
     member s.SignStream stream =