Skip to content

Commit 1e94de3

Browse files
pranjalkolepranjalkole
committed
corim/signedcorim: check for mandatory alg and kid
* Added the kid parameter to the failing tests * Added getKidFromJWK in corim/signer.go * Regenerated all testcases * Made regen-from-src.sh executable Signed-off-by: Pranjal Kole <[email protected]>
1 parent e629156 commit 1e94de3

10 files changed

+69
-21
lines changed

‎corim/signedcorim.go‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,18 +59,38 @@ func (o *SignedCorim) processHdrs() error {
5959
return errors.New("missing mandatory protected header")
6060
}
6161

62-
v, ok := hdr.Protected[cose.HeaderLabelContentType]
62+
v, ok := hdr.Protected[cose.HeaderLabelAlgorithm]
63+
if !ok {
64+
return errors.New("missing mandatory algorithm")
65+
}
66+
67+
// TODO: make this consistent, either int64 or cose.Algorithm
68+
// cose.Algorithm is an alias to int64 defined in veraison/go-cose
69+
switch v.(type) {
70+
case int64:
71+
case cose.Algorithm:
72+
default:
73+
return fmt.Errorf("expecting integer CoRIM Algorithm, got %T instead", v)
74+
}
75+
76+
v, ok = hdr.Protected[cose.HeaderLabelContentType]
6377
if !ok {
6478
return errors.New("missing mandatory content type")
6579
}
6680

81+
_, ok = v.(string)
82+
if !ok {
83+
return fmt.Errorf("expecting byte string CoRIM Key ID, got %T instead", v)
84+
}
85+
6786
if v != ContentType {
6887
return fmt.Errorf("expecting content type %q, got %q instead", ContentType, v)
6988
}
7089

71-
// TODO(tho) key id is apparently mandatory, which doesn't look right.
72-
// TODO(tho) Check with the CoRIM design team.
73-
// See https://github.com/veraison/corim/issues/14
90+
v, ok = hdr.Protected[cose.HeaderLabelKeyID]
91+
if !ok {
92+
return errors.New("missing mandatory key id")
93+
}
7494

7595
v, ok = hdr.Protected[HeaderLabelCorimMeta]
7696
if !ok {
@@ -129,7 +149,7 @@ func (o *SignedCorim) FromCOSE(buf []byte) error {
129149
// Sign returns the serialized signed-corim, signed by the supplied cose Signer.
130150
// The target SignedCorim must have its UnsignedCorim field correctly
131151
// populated.
132-
func (o *SignedCorim) Sign(signer cose.Signer) ([]byte, error) {
152+
func (o *SignedCorim) Sign(signer cose.Signer, kid []byte) ([]byte, error) {
133153
if signer == nil {
134154
return nil, errors.New("nil signer")
135155
}
@@ -159,6 +179,7 @@ func (o *SignedCorim) Sign(signer cose.Signer) ([]byte, error) {
159179

160180
o.message.Headers.Protected.SetAlgorithm(alg)
161181
o.message.Headers.Protected[cose.HeaderLabelContentType] = ContentType
182+
o.message.Headers.Protected[cose.HeaderLabelKeyID] = kid
162183
o.message.Headers.Protected[HeaderLabelCorimMeta] = metaCBOR
163184

164185
err = o.message.Sign(rand.Reader, NoExternalData, signer)

‎corim/signedcorim_test.go‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,7 @@ func TestSignedCorim_FromCOSE_fail_corim_bad_cbor(t *testing.T) {
286286
/ protected / << {
287287
/ alg / 1: -7, / ECDSA 256 /
288288
/ content-type / 3: "application/rim+cbor",
289+
/ kid / 4: h'1',
289290
/ corim-meta / 8: h'a200a1006941434d45204c74642e01a101c11a5fad2056'
290291
} >>,
291292
/ unprotected / {},
@@ -295,12 +296,12 @@ func TestSignedCorim_FromCOSE_fail_corim_bad_cbor(t *testing.T) {
295296
)
296297
*/
297298
tv := []byte{
298-
0xd2, 0x84, 0x58, 0x32, 0xa3, 0x01, 0x26, 0x03, 0x74, 0x61, 0x70, 0x70,
299+
0xd2, 0x84, 0x58, 0x35, 0xa4, 0x01, 0x26, 0x03, 0x74, 0x61, 0x70, 0x70,
299300
0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x72, 0x69, 0x6d,
300-
0x2b, 0x63, 0x62, 0x6f, 0x72, 0x08, 0x57, 0xa2, 0x00, 0xa1, 0x00, 0x69,
301-
0x41, 0x43, 0x4d, 0x45, 0x20, 0x4c, 0x74, 0x64, 0x2e, 0x01, 0xa1, 0x01,
302-
0xc1, 0x1a, 0x5f, 0xad, 0x20, 0x56, 0xa0, 0x44, 0xba, 0xdc, 0xb0, 0x30,
303-
0x44, 0xde, 0xad, 0xbe, 0xef,
301+
0x2b, 0x63, 0x62, 0x6f, 0x72, 0x04, 0x41, 0x31, 0x08, 0x57, 0xa2, 0x00,
302+
0xa1, 0x00, 0x69, 0x41, 0x43, 0x4d, 0x45, 0x20, 0x4c, 0x74, 0x64, 0x2e,
303+
0x01, 0xa1, 0x01, 0xc1, 0x1a, 0x5f, 0xad, 0x20, 0x56, 0xa0, 0x44, 0xba,
304+
0xdc, 0xb0, 0x30, 0x44, 0xde, 0xad, 0xbe, 0xef,
304305
}
305306

306307
var actual SignedCorim
@@ -316,6 +317,7 @@ func TestSignedCorim_FromCOSE_fail_invalid_corim(t *testing.T) {
316317
/ protected / << {
317318
/ alg / 1: -7, / ECDSA 256 /
318319
/ content-type / 3: "application/rim+cbor",
320+
/ kid / 4: h'1',
319321
/ corim-meta / 8: h'a200a1006941434d45204c74642e01a101c11a5fad2056'
320322
} >>,
321323
/ unprotected / {},
@@ -327,13 +329,13 @@ func TestSignedCorim_FromCOSE_fail_invalid_corim(t *testing.T) {
327329
)
328330
*/
329331
tv := []byte{
330-
0xd2, 0x84, 0x58, 0x32, 0xa3, 0x01, 0x26, 0x03, 0x74, 0x61, 0x70, 0x70,
332+
0xd2, 0x84, 0x58, 0x35, 0xa4, 0x01, 0x26, 0x03, 0x74, 0x61, 0x70, 0x70,
331333
0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x72, 0x69, 0x6d,
332-
0x2b, 0x63, 0x62, 0x6f, 0x72, 0x08, 0x57, 0xa2, 0x00, 0xa1, 0x00, 0x69,
333-
0x41, 0x43, 0x4d, 0x45, 0x20, 0x4c, 0x74, 0x64, 0x2e, 0x01, 0xa1, 0x01,
334-
0xc1, 0x1a, 0x5f, 0xad, 0x20, 0x56, 0xa0, 0x50, 0xa1, 0x00, 0x6d, 0x69,
335-
0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x63, 0x6f, 0x72, 0x69, 0x6d,
336-
0x44, 0xde, 0xad, 0xbe, 0xef,
334+
0x2b, 0x63, 0x62, 0x6f, 0x72, 0x04, 0x41, 0x31, 0x08, 0x57, 0xa2, 0x00,
335+
0xa1, 0x00, 0x69, 0x41, 0x43, 0x4d, 0x45, 0x20, 0x4c, 0x74, 0x64, 0x2e,
336+
0x01, 0xa1, 0x01, 0xc1, 0x1a, 0x5f, 0xad, 0x20, 0x56, 0xa0, 0x50, 0xa1,
337+
0x00, 0x6d, 0x69, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x63, 0x6f,
338+
0x72, 0x69, 0x6d, 0x44, 0xde, 0xad, 0xbe, 0xef,
337339
}
338340

339341
var actual SignedCorim
@@ -435,13 +437,15 @@ func TestSignedCorim_SignVerify_ok(t *testing.T) {
435437
} {
436438
signer, err := NewSignerFromJWK(key)
437439
require.NoError(t, err)
440+
kid, err := getKidFromJWK(key)
441+
require.NoError(t, err)
438442

439443
var SignedCorimIn SignedCorim
440444

441445
SignedCorimIn.UnsignedCorim = *unsignedCorimFromCBOR(t, testGoodUnsignedCorimCBOR)
442446
SignedCorimIn.Meta = *metaGood(t)
443447

444-
cbor, err := SignedCorimIn.Sign(signer)
448+
cbor, err := SignedCorimIn.Sign(signer, kid)
445449
assert.Nil(t, err)
446450

447451
var SignedCorimOut SignedCorim
@@ -462,12 +466,14 @@ func TestSignedCorim_SignVerify_ok(t *testing.T) {
462466
func TestSignedCorim_SignVerify_fail_tampered(t *testing.T) {
463467
signer, err := NewSignerFromJWK(testES256Key)
464468
require.NoError(t, err)
469+
kid, err := getKidFromJWK(testES256Key)
470+
require.NoError(t, err)
465471

466472
var SignedCorimIn SignedCorim
467473

468474
SignedCorimIn.UnsignedCorim = *unsignedCorimFromCBOR(t, testGoodUnsignedCorimCBOR)
469475

470-
cbor, err := SignedCorimIn.Sign(signer)
476+
cbor, err := SignedCorimIn.Sign(signer, kid)
471477
assert.Nil(t, err)
472478

473479
var SignedCorimOut SignedCorim
@@ -493,6 +499,8 @@ func TestSignedCorim_SignVerify_fail_tampered(t *testing.T) {
493499
func TestSignedCorim_Sign_fail_bad_corim(t *testing.T) {
494500
signer, err := NewSignerFromJWK(testES256Key)
495501
require.NoError(t, err)
502+
kid, err := getKidFromJWK(testES256Key)
503+
require.NoError(t, err)
496504

497505
var SignedCorimIn SignedCorim
498506

@@ -501,7 +509,7 @@ func TestSignedCorim_Sign_fail_bad_corim(t *testing.T) {
501509

502510
SignedCorimIn.UnsignedCorim = *emptyCorim
503511

504-
_, err = SignedCorimIn.Sign(signer)
512+
_, err = SignedCorimIn.Sign(signer, kid)
505513
assert.EqualError(t, err, "failed validation of unsigned CoRIM: empty id")
506514
}
507515

@@ -513,7 +521,7 @@ func TestSignedCorim_Sign_fail_no_signer(t *testing.T) {
513521

514522
SignedCorimIn.UnsignedCorim = *emptyCorim
515523

516-
_, err := SignedCorimIn.Sign(nil)
524+
_, err := SignedCorimIn.Sign(nil, nil)
517525
assert.EqualError(t, err, "nil signer")
518526
}
519527

‎corim/signer.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,25 @@ func getAlgAndKeyFromJWK(j []byte) (cose.Algorithm, crypto.Signer, error) {
154154
return alg, key, nil
155155
}
156156

157+
func getKidFromJWK(j []byte) ([]byte, error) {
158+
k, err := jwk.ParseKey(j)
159+
if err != nil {
160+
return nil, err
161+
}
162+
163+
if k.KeyID() != "" {
164+
return []byte(k.KeyID()), nil
165+
}
166+
167+
// Generate a key ID from the JWK Thumbprint if none exist
168+
// See https://datatracker.ietf.org/doc/html/rfc7638
169+
kid, err := k.Thumbprint(crypto.SHA256)
170+
if err != nil {
171+
return nil, err
172+
}
173+
return kid, nil
174+
}
175+
157176
func ellipticCurveToAlg(c elliptic.Curve) cose.Algorithm {
158177
switch c {
159178
case elliptic.P256():

‎corim/testcases/regen-from-src.sh‎

100644100755
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ GEN_TESTCASE=$(go env GOPATH)/bin/gen-testcase
77

88
if [[ ! -f ${GEN_TESTCASE} ]]; then
99
echo "installing gen-testcase"
10-
go install github.com/veraison/[email protected].1
10+
go install github.com/veraison/[email protected].2
1111
fi
1212

1313
testcases=(

‎corim/testcases/signed-corim-with-extensions.cbor‎

3 Bytes
Binary file not shown.

‎corim/testcases/signed-example-corim.cbor‎

3 Bytes
Binary file not shown.

‎corim/testcases/signed-good-corim.cbor‎

3 Bytes
Binary file not shown.

‎corim/testcases/unsigned-corim-with-extensions.cbor‎

0 Bytes
Binary file not shown.

‎corim/testcases/unsigned-example-corim.cbor‎

0 Bytes
Binary file not shown.

‎corim/testcases/unsigned-good-corim.cbor‎

0 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)