Skip to content

Commit 2e5b1e2

Browse files
committed
Add tests for the changes in PKCS7 signing
1 parent d8bc890 commit 2e5b1e2

File tree

1 file changed

+45
-2
lines changed

1 file changed

+45
-2
lines changed

tests/hazmat/primitives/test_pkcs7.py

+45-2
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,45 @@ def test_sign_text(self, backend):
557557
backend,
558558
)
559559

560+
def test_smime_capabilities(self, backend):
561+
data = b"hello world"
562+
cert, key = _load_cert_key()
563+
builder = (
564+
pkcs7.PKCS7SignatureBuilder()
565+
.set_data(data)
566+
.add_signer(cert, key, hashes.SHA256())
567+
)
568+
569+
options = []
570+
sig_binary = builder.sign(serialization.Encoding.DER, options)
571+
572+
# 1.2.840.113549.1.9.15 (SMIMECapabilities) as an ASN.1 DER encoded OID
573+
assert b"\x06\t*\x86H\x86\xf7\r\x01\t\x0f" in sig_binary
574+
575+
# 2.16.840.1.101.3.4.1.42 (aes256-CBC-PAD) as an ASN.1 DER encoded OID
576+
aes256_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x2A"
577+
# 2.16.840.1.101.3.4.1.22 (aes192-CBC-PAD) as an ASN.1 DER encoded OID
578+
aes192_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x16"
579+
# 2.16.840.1.101.3.4.1.2 (aes128-CBC-PAD) as an ASN.1 DER encoded OID
580+
aes128_cbc_pad_oid = b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x01\x02"
581+
582+
# Each algorithm in SMIMECapabilities should be inside its own SEQUENCE.
583+
# This is encoded as SEQUENCE_IDENTIFIER + LENGTH + ALGORITHM_OID. This
584+
# tests that each algorithm is indeed encoded inside its own sequence.
585+
# See RFC 2633, Appendix A for more details.
586+
sequence_identifier = b"\x30"
587+
for oid in [aes256_cbc_pad_oid, aes192_cbc_pad_oid, aes128_cbc_pad_oid]:
588+
assert sequence_identifier + len(oid).to_bytes() + oid in sig_binary
589+
590+
_pkcs7_verify(
591+
serialization.Encoding.DER,
592+
sig_binary,
593+
None,
594+
[cert],
595+
options,
596+
backend,
597+
)
598+
560599
def test_sign_no_capabilities(self, backend):
561600
data = b"hello world"
562601
cert, key = _load_cert_key()
@@ -677,9 +716,13 @@ def test_rsa_pkcs_padding_options(self, pad, backend):
677716
sig.count(b"\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x08") == 1
678717
)
679718
else:
680-
# This should be a pkcs1 sha512 signature
719+
# This should be a pkcs1 RSA signature, which uses the `rsaEncryption`
720+
# OID (1.2.840.113549.1.1.1) no matter which digest algorithm is used.
721+
# See RFC 3370 section 3.2 for more details.
722+
# This OID appears twice, once in the certificate itself and another in
723+
# the SignerInfo data structure in the `digest_encryption_algorithm` field.
681724
assert (
682-
sig.count(b"\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0D") == 1
725+
sig.count(b"\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01") == 2
683726
)
684727
_pkcs7_verify(
685728
serialization.Encoding.DER,

0 commit comments

Comments
 (0)