Skip to content

Commit 2755b62

Browse files
committed
Add tests for the changes in PKCS7 signing
1 parent 2c1e981 commit 2755b62

File tree

1 file changed

+52
-2
lines changed

1 file changed

+52
-2
lines changed

tests/hazmat/primitives/test_pkcs7.py

+52-2
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,50 @@ def test_sign_text(self, backend):
557557
backend,
558558
)
559559

560+
def test_smime_capabilities(self, backend):
561+
data = b"hello world"
562+
cert, key = _load_cert_key()
563+
builder = (
564+
pkcs7.PKCS7SignatureBuilder()
565+
.set_data(data)
566+
.add_signer(cert, key, hashes.SHA256())
567+
)
568+
569+
sig_binary = builder.sign(serialization.Encoding.DER, [])
570+
571+
# 1.2.840.113549.1.9.15 (SMIMECapabilities) as an ASN.1 DER encoded OID
572+
assert b"\x06\t*\x86H\x86\xf7\r\x01\t\x0f" in sig_binary
573+
574+
# 2.16.840.1.101.3.4.1.42 (aes256-CBC-PAD) as an ASN.1 DER encoded OID
575+
aes256_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x2A"
576+
# 2.16.840.1.101.3.4.1.22 (aes192-CBC-PAD) as an ASN.1 DER encoded OID
577+
aes192_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x16"
578+
# 2.16.840.1.101.3.4.1.2 (aes128-CBC-PAD) as an ASN.1 DER encoded OID
579+
aes128_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x02"
580+
581+
# Each algorithm in SMIMECapabilities should be inside its own
582+
# SEQUENCE.
583+
# This is encoded as SEQUENCE_IDENTIFIER + LENGTH + ALGORITHM_OID.
584+
# This tests that each algorithm is indeed encoded inside its own
585+
# sequence. See RFC 2633, Appendix A for more details.
586+
sequence_identifier = b"\x30"
587+
for oid in [
588+
aes256_cbc_pad_oid,
589+
aes192_cbc_pad_oid,
590+
aes128_cbc_pad_oid,
591+
]:
592+
len_oid = len(oid).to_bytes(length=1, byteorder="big")
593+
assert sequence_identifier + len_oid + oid in sig_binary
594+
595+
_pkcs7_verify(
596+
serialization.Encoding.DER,
597+
sig_binary,
598+
None,
599+
[cert],
600+
[],
601+
backend,
602+
)
603+
560604
def test_sign_no_capabilities(self, backend):
561605
data = b"hello world"
562606
cert, key = _load_cert_key()
@@ -677,9 +721,15 @@ def test_rsa_pkcs_padding_options(self, pad, backend):
677721
sig.count(b"\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x08") == 1
678722
)
679723
else:
680-
# This should be a pkcs1 sha512 signature
724+
# This should be a pkcs1 RSA signature, which uses the
725+
# `rsaEncryption` OID (1.2.840.113549.1.1.1) no matter which
726+
# digest algorithm is used.
727+
# See RFC 3370 section 3.2 for more details.
728+
# This OID appears twice, once in the certificate itself and
729+
# another in the SignerInfo data structure in the
730+
# `digest_encryption_algorithm` field.
681731
assert (
682-
sig.count(b"\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0D") == 1
732+
sig.count(b"\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01") == 2
683733
)
684734
_pkcs7_verify(
685735
serialization.Encoding.DER,

0 commit comments

Comments
 (0)