header: fix authentication when protected header is zero-length map

src/encrypt/mod.rs

@@ -496,7 +496,7 @@ pub fn enc_structure_data(
 ) -> Vec<u8> {
  let arr = vec![
  Value::Text(context.text().to_owned()),
- protected.cbor_bstr().expect("failed to serialize header"), // safe: always serializable
+ protected.to_be_authenticated().expect("failed to serialize header"), // safe: always serializable
  Value::Bytes(external_aad.to_vec()),
  ];
 

src/header/mod.rs

@@ -385,6 +385,19 @@ impl ProtectedHeader {
  ))
  }
 
+ pub fn to_be_authenticated(self) -> Result<Value> {
+ let result = self.cbor_bstr()?;
+ // protected header might have been encoded as a zero length map, only containing
+ // the byte 0xA0 (see RFC 9052, Section 3).
+ // However, this byte should not be included during authentication (RFC 9052, Section 4.4,
+ // 5.3 and 6.3), so we need to return an empty byte string here instead.
+ if result.eq(&Value::Bytes(vec![0xA0])) {
+ Ok(Value::Bytes(vec![]))
+ } else {
+ Ok(result)
+ }
+ }
+
  /// Indicate whether the `ProtectedHeader` is empty.
  pub fn is_empty(&self) -> bool {
  self.header.is_empty()

src/mac/mod.rs

@@ -336,7 +336,7 @@ pub fn mac_structure_data(
 ) -> Vec<u8> {
  let arr = vec![
  Value::Text(context.text().to_owned()),
- protected.cbor_bstr().expect("failed to serialize header"), // safe: always serializable
+ protected.to_be_authenticated().expect("failed to serialize header"), // safe: always serializable
  Value::Bytes(external_aad.to_vec()),
  Value::Bytes(payload.to_vec()),
  ];

src/sign/mod.rs

@@ -518,13 +518,16 @@ pub fn sig_structure_data(
  aad: &[u8],
  payload: &[u8],
 ) -> Vec<u8> {
+
  let mut arr = vec![
  Value::Text(context.text().to_owned()),
- body.cbor_bstr().expect("failed to serialize header"), // safe: always serializable
+ body.to_be_authenticated().expect("failed to serialize header"), // safe: always serializable
  ];
  if let Some(sign) = sign {
- arr.push(sign.cbor_bstr().expect("failed to serialize header")); // safe: always
- // serializable
+ arr.push(
+ sign.to_be_authenticated()
+ .expect("failed to serialize header") // safe: always serializable
+ );
  }
  arr.push(Value::Bytes(aad.to_vec()));
  arr.push(Value::Bytes(payload.to_vec()));