[opentitantool]: fix hashed SPX signature verification #24482
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vbendeb
requested review from
HU90m,
cfrantz and
timothytrippel
and removed request for
a team
cfrantz
reviewed
Sep 3, 2024
| @@ -83,7 +83,12 @@ impl SigverifyParams { | |||
| // Verify the optional SPX+ signature. | |||
| pub fn spx_verify(&self, b: &[u8], domain: SpxDomain) -> Result<()> { | |||
| if let Some(spx) = &self.spx_sig_params { | |||
| spx.key.verify(domain, &spx.signature, b)?; | |||
| let hash = sha256::sha256(b).to_le_bytes(); | |||
There was a problem hiding this comment.
The hash calculation should be inside the match case for PreHashedSha256.
You probably have to use a Cow (copy-on-write) reference to deal with the difference between the hash result (Vec<u8>) vs. the slice ([u8]):
let msg = match domain {
PreHashedSha256 => Cow::from(sha256::sha256(b).to_le_bytes()),
_ => Cow::from(b),
}
There was a problem hiding this comment.
I tried to create the hash in the match case, but it did not have long enough life time, looks like Cow::from() takes care of this, done.
In case of SPX signing using the PrehashedSha256 domain the image payload needs to be hashed both before signing and before validating the signature. The validation path was not hashing the image which was causing signature validation failures. Tested by verifying pure and hashed SPX signing cases. Change-Id: I055d2c5717b7280d9e5a11a93e54815ad9a707cd Signed-off-by: Vadim Bendebury <[email protected]>
cfrantz
approved these changes
Sep 3, 2024
timothytrippel
approved these changes
Sep 4, 2024
timothytrippel
added
the
CherryPick:earlgrey_1.0.0
|
Successfully created backport PR for |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In case of SPX signing using the PrehashedSha256 domain the image payload needs to be hashed both before signing and before validating the signature.
The validation path was not hashing the image which was causing signature validation failures.
Tested by verifying pure and hashed SPX signing cases.
Change-Id: I055d2c5717b7280d9e5a11a93e54815ad9a707cd