Skip to content

Commit 602679e

Browse files
vitali-prvitali-pr
committed
Support RSASSA-PSS parameters on .NET with BC
DEVSIX-8417
1 parent 8404dab commit 602679e

File tree

7 files changed

+75
-24
lines changed

7 files changed

+75
-24
lines changed

‎itext.tests/itext.sign.tests/itext/signatures/PdfPKCS7ManuallyPortedTest.cs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,16 @@ public virtual void VerifyRsaSha3SignatureTest() {
7272
VerifyIsoExtensionExample("SHA3-256withRSA", "sample-rsa-sha3_256.pdf");
7373
}
7474
}
75+
76+
[NUnit.Framework.Test]
77+
public virtual void VerifyRsaPssSha3SignatureTest()
78+
{
79+
if ("BC".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName())) {
80+
VerifyIsoExtensionExample("RSASSA-PSS", "sample-pss-sha3_256.pdf");
81+
} else {
82+
// Signer "RSASSA-PSS not recognised in BCFIPS mode
83+
NUnit.Framework.Assert.Catch(typeof(PdfException), () => VerifyIsoExtensionExample("RSASSA-PSS", "sample-pss-sha3_256.pdf"));
84+
}
85+
}
7586
}
7687
}

‎itext.tests/itext.sign.tests/itext/signatures/sign/IsoSignatureExtensionsRoundtripTest.cs‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,18 @@ public virtual void TestRsaWithSha3_512() {
142142
}
143143

144144
[NUnit.Framework.Test]
145-
public virtual void TestRsaWithSha3_256() {
145+
public virtual void TestRsaSsaPssWithSha3_256()
146+
{
147+
if ("BC".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName())) {
148+
DoRoundTrip("rsa", DigestAlgorithms.SHA3_256, "RSASSA-PSS", new DerObjectIdentifier(SecurityIDs.ID_RSASSA_PSS));
149+
} else {
150+
// Signer RSASSA-PSS not recognised in BCFIPS mode
151+
NUnit.Framework.Assert.Catch(typeof(PdfException), () => DoRoundTrip("rsa", DigestAlgorithms.SHA3_256, "RSASSA-PSS", new DerObjectIdentifier(SecurityIDs.ID_RSASSA_PSS)));
152+
}
153+
}
154+
155+
[NUnit.Framework.Test]
156+
public virtual void TestDsaWithSha3_256() {
146157
if ("BCFIPS".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName())) {
147158
DoRoundTrip("dsa", DigestAlgorithms.SHA3_256, NistObjectIdentifiers.IdDsaWithSha3_256);
148159
} else {

‎itext.tests/itext.sign.tests/itext/signatures/sign/RSASSAPSSTest.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ public virtual void SignWithRsaSsaPssTest()
6565
String cmpFileName = "cmp_simplePssSignature.pdf";
6666
if ("BCFIPS".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName()))
6767
{
68-
// Signer RSASSA-PSS not recognised in BC mode
68+
// Signer RSASSA-PSS not recognised in BCFIPS mode
6969
NUnit.Framework.Assert.Catch(typeof(PdfException), () =>
7070
{
7171
DoRoundTrip(digestName, "RSASSA-PSS", outFileName,
@@ -91,7 +91,7 @@ public virtual void SignWithRsaSsaPssAlternativeNomenclatureTest()
9191

9292
if ("BCFIPS".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName()))
9393
{
94-
// Signer RSASSA-PSS not recognised in BC mode
94+
// Signer RSASSA-PSS not recognised in BCFIPS mode
9595
NUnit.Framework.Assert.Catch(typeof(PdfException), () =>
9696
{
9797
DoRoundTrip(digestName,
@@ -116,7 +116,7 @@ public virtual void SignWithRsaSsaSha384PssTest() {
116116
String outFileName = "simplePssSignatureSha384.pdf";
117117
if ("BCFIPS".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName()))
118118
{
119-
// Signer RSASSA-PSS not recognised in BC mode
119+
// Signer RSASSA-PSS not recognised in BCFIPS mode
120120
NUnit.Framework.Assert.Catch(typeof(PdfException), () =>
121121
{
122122
DoRoundTrip(digestName, "RSASSA-PSS", outFileName,
@@ -137,7 +137,7 @@ public virtual void SignWithRsaSsaCustomSaltLengthTest() {
137137
String cmpFileName = "cmp_simplePssSignature.pdf";
138138

139139
if ("BCFIPS".Equals(BOUNCY_CASTLE_FACTORY.GetProviderName())) {
140-
// Signer RSASSA-PSS not recognised in BC mode
140+
// Signer RSASSA-PSS not recognised in BCFIPS mode
141141
NUnit.Framework.Assert.Catch(typeof(PdfException), () =>
142142
{
143143
DoRoundTrip(digestName, "RSASSA-PSS", outFileName, new RSASSAPSSMechanismParams(

‎itext/itext.bouncy-castle-adapter/itext/bouncycastle/crypto/SignerBC.cs‎

Lines changed: 30 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,23 @@ public void InitSign(IPrivateKey key) {
6666
InitSign(key, lastHashAlgorithm, lastEncryptionAlgorithm);
6767
}
6868

69+
/// <summary><inheritDoc/></summary>
70+
public void InitRsaPssSigner(string digestAlgoName, int saltLen, int trailerField) {
71+
if (iSigner != null) {
72+
return;
73+
}
74+
// If trailerField == 1 then trailer = 0xBC (it's the default one)
75+
if (trailerField != 1) {
76+
throw new ArgumentException("unknown trailer field");
77+
}
78+
79+
Org.BouncyCastle.Crypto.IDigest digest = Org.BouncyCastle.Security.DigestUtilities.GetDigest(digestAlgoName);
80+
Org.BouncyCastle.Crypto.ISigner signer = new Org.BouncyCastle.Crypto.Signers.PssSigner(
81+
new Org.BouncyCastle.Crypto.Engines.RsaBlindedEngine(), digest, digest, saltLen, 0xBC);
82+
83+
this.iSigner = signer;
84+
}
85+
6986
/// <summary><inheritDoc/></summary>
7087
public void Update(byte[] buf, int off, int len) {
7188
iSigner.BlockUpdate(buf, off, len);
@@ -130,23 +147,24 @@ public override String ToString() {
130147
}
131148

132149
private void InitVerify(IPublicKey publicKey, string hashAlgorithm, string encrAlgorithm) {
133-
if (string.IsNullOrEmpty(hashAlgorithm)) {
134-
iSigner = SignerUtilities.GetSigner(encrAlgorithm);
135-
} else {
136-
iSigner = SignerUtilities.GetSigner(hashAlgorithm + "with" + encrAlgorithm);
150+
if (iSigner == null) {
151+
if (string.IsNullOrEmpty(hashAlgorithm)) {
152+
iSigner = SignerUtilities.GetSigner(encrAlgorithm);
153+
} else {
154+
iSigner = SignerUtilities.GetSigner(hashAlgorithm + "with" + encrAlgorithm);
155+
}
137156
}
138-
157+
139158
iSigner.Init(false, ((PublicKeyBC) publicKey).GetPublicKey());
140159
}
141160

142161
private void InitSign(IPrivateKey key, string hashAlgorithm, string encrAlgorithm) {
143-
if (string.IsNullOrEmpty(hashAlgorithm))
144-
{
145-
iSigner = SignerUtilities.GetSigner(encrAlgorithm);
146-
}
147-
else
148-
{
149-
iSigner = SignerUtilities.GetSigner(hashAlgorithm + "with" + encrAlgorithm);
162+
if (iSigner == null) {
163+
if (string.IsNullOrEmpty(hashAlgorithm)) {
164+
iSigner = SignerUtilities.GetSigner(encrAlgorithm);
165+
} else {
166+
iSigner = SignerUtilities.GetSigner(hashAlgorithm + "with" + encrAlgorithm);
167+
}
150168
}
151169

152170
iSigner.Init(true, ((PrivateKeyBC) key).GetPrivateKey());

‎itext/itext.bouncy-castle-fips-adapter/itext/bouncycastlefips/crypto/SignerBCFips.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ public void InitSign(IPrivateKey key) {
6969
InitSign(key, lastHashAlgorithm, lastEncryptionAlgorithm);
7070
}
7171

72+
/// <summary><inheritDoc/></summary>
73+
public void InitRsaPssSigner(string digestAlgoName, int saltLen, int trailerField) {
74+
// Not supported yet
75+
// Leave empty, we will throw in another place
76+
}
77+
7278
/// <summary><inheritDoc/></summary>
7379
public void Update(byte[] buf, int off, int len) {
7480
if (digest != null) {

‎itext/itext.commons/itext/commons/bouncycastle/crypto/ISigner.cs‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,15 @@ public interface ISigner {
4141
/// </summary>
4242
/// <param name="publicKey">public key</param>
4343
void InitSign(IPrivateKey key);
44-
44+
45+
/// <summary>
46+
/// Creates actual signer object to create RSASSA-PSS signature
47+
/// </summary>
48+
/// <param name="digestAlgoName">digect algorithm</param>
49+
/// <param name="saltLen">salt length</param>
50+
/// <param name="trailerField">trailer field</param>
51+
void InitRsaPssSigner(string digestAlgoName, int saltLen, int trailerField);
52+
4553
/// <summary>
4654
/// Calls actual
4755
/// <c>Update</c>

‎itext/itext.sign/itext/signatures/SignUtils.cs‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -267,12 +267,9 @@ internal static IEnumerable<IX509Certificate> GetCertificates(List<IX509Certific
267267
return rootStore;
268268
}
269269

270-
internal static void SetRSASSAPSSParamsWithMGF1(ISigner signature, String digestAlgoName, int saltLen, int trailerField)
271-
{
272-
// var mgf1Spec = new MgfParameters() MGF1ParameterSpec(digestAlgoName);
273-
// PSSParameterSpec spec = new Pss PSSParameterSpec(digestAlgoName, "MGF1", mgf1Spec, saltLen, trailerField);
274-
// signature. setParameter(spec);
275-
}
270+
internal static void SetRSASSAPSSParamsWithMGF1(ISigner signature, String digestAlgoName, int saltLen, int trailerField) {
271+
signature.InitRsaPssSigner(digestAlgoName, saltLen, trailerField);
272+
}
276273

277274
internal static void UpdateVerifier(ISigner sig, byte[] digest) {
278275
sig.UpdateVerifier(digest);

0 commit comments

Comments
 (0)