[openssl-commits] [openssl] OpenSSL_1_1_0-stable update
Kurt Roeckx
kurt at openssl.org
Mon Nov 7 20:09:30 UTC 2016
The branch OpenSSL_1_1_0-stable has been updated
via b9ddc5fd0ccb6ec92b5178db1f169d431f2a3ff3 (commit)
via 439530bc571a5221ba0df983a245b525f46c9898 (commit)
via b71079a375116a8a52ed493afcd8f69cb08c195a (commit)
from 929cc3fa6bceba1c6d9c362c56b89cbf2acf40bc (commit)
- Log -----------------------------------------------------------------
commit b9ddc5fd0ccb6ec92b5178db1f169d431f2a3ff3
Author: David Benjamin <davidben at google.com>
Date: Sun Nov 6 19:12:47 2016 -0500
Improve RSA test coverage.
MD5/SHA1 and MDC-2 have special-case logic beyond the generic DigestInfo
wrapping. Test that each of these works, including hash and length
mismatches (both input and signature). Also add VerifyRecover tests. It
appears 5824cc298174d462c827cd090675e30fc03f0caf added support for
VerifyRecover, but forgot to add the test data.
Reviewed-by: Kurt Roeckx <kurt at roeckx.be>
Reviewed-by: Rich Salz <rsalz at openssl.org>
GH: #1474
(cherry picked from commit f320555735af7aa52172a2b8c56181445e8490dd)
commit 439530bc571a5221ba0df983a245b525f46c9898
Author: David Benjamin <davidben at google.com>
Date: Sat Aug 20 15:48:56 2016 -0400
Make RSA_sign.pod less confusing.
PKCS #1 v2.0 is the name of a document which specifies an algorithm
RSASSA-PKCS1-v1_5, often referred to as "PKCS #1 v1.5" after an earlier
document which specified it. This gets further confusing because the
document PKCS #1 v2.1 specifies two signature algorithms,
RSASSA-PKCS1-v1_5 and RSASSA-PSS. RSA_sign implements RSASSA-PKCS1-v1_5.
Refer to the document using the RFC number which is easier to find
anyway, and refer to the algorithm by its name.
Reviewed-by: Kurt Roeckx <kurt at roeckx.be>
Reviewed-by: Rich Salz <rsalz at openssl.org>
GH: #1474
(cherry picked from commit aa90ca11c930114d5c0d68a2c1f446bf97853287)
commit b71079a375116a8a52ed493afcd8f69cb08c195a
Author: David Benjamin <davidben at google.com>
Date: Sat Aug 20 13:35:17 2016 -0400
Implement RSASSA-PKCS1-v1_5 as specified.
RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode
the DigestInfo struct and then compare the result against the public key
operation result. This implies that one and only one encoding is legal.
OpenSSL instead parses with crypto/asn1, then checks that the encoding
round-trips, and allows some variations for the parameter. Sufficient
laxness in this area can allow signature forgeries, as described in
https://www.imperialviolet.org/2014/09/26/pkcs1.html
Although there aren't known attacks against OpenSSL's current scheme,
this change makes OpenSSL implement the algorithm as specified. This
avoids the uncertainty and, more importantly, helps grow a healthy
ecosystem. Laxness beyond the spec, particularly in implementations
which enjoy wide use, risks harm to the ecosystem for all. A signature
producer which only tests against OpenSSL may not notice bugs and
accidentally become widely deployed. Thus implementations have a
responsibility to honor the specification as tightly as is practical.
In some cases, the damage is permanent and the spec deviation and
security risk becomes a tax all implementors must forever pay, but not
here. Both BoringSSL and Go successfully implemented and deployed
RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so
this change should be compatible enough to pin down in future OpenSSL
releases.
See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00
As a bonus, by not having to deal with sign/verify differences, this
version is also somewhat clearer. It also more consistently enforces
digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath
wasn't quite doing this right.
Reviewed-by: Kurt Roeckx <kurt at roeckx.be>
Reviewed-by: Rich Salz <rsalz at openssl.org>
GH: #1474
(cherry picked from commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836)
-----------------------------------------------------------------------
Summary of changes:
crypto/rsa/rsa_err.c | 1 +
crypto/rsa/rsa_sign.c | 324 ++++++++++++++++++++++++++----------------------
doc/crypto/RSA_sign.pod | 6 +-
include/openssl/rsa.h | 1 +
test/evptests.txt | 139 ++++++++++++++++++++-
5 files changed, 316 insertions(+), 155 deletions(-)
diff --git a/crypto/rsa/rsa_err.c b/crypto/rsa/rsa_err.c
index 210709e..45e12e0 100644
--- a/crypto/rsa/rsa_err.c
+++ b/crypto/rsa/rsa_err.c
@@ -20,6 +20,7 @@
static ERR_STRING_DATA RSA_str_functs[] = {
{ERR_FUNC(RSA_F_CHECK_PADDING_MD), "check_padding_md"},
+ {ERR_FUNC(RSA_F_ENCODE_PKCS1), "encode_pkcs1"},
{ERR_FUNC(RSA_F_INT_RSA_VERIFY), "int_rsa_verify"},
{ERR_FUNC(RSA_F_OLD_RSA_PRIV_DECODE), "old_rsa_priv_decode"},
{ERR_FUNC(RSA_F_PKEY_RSA_CTRL), "pkey_rsa_ctrl"},
diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c
index 8946e19..952d24f 100644
--- a/crypto/rsa/rsa_sign.c
+++ b/crypto/rsa/rsa_sign.c
@@ -19,208 +19,230 @@
/* Size of an SSL signature: MD5+SHA1 */
#define SSL_SIG_LENGTH 36
-int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
- unsigned char *sigret, unsigned int *siglen, RSA *rsa)
+/*
+ * encode_pkcs1 encodes a DigestInfo prefix of hash |type| and digest |m|, as
+ * described in EMSA-PKCS1-v1_5-ENCODE, RFC 3447 section 9.2 step 2. This
+ * encodes the DigestInfo (T and tLen) but does not add the padding.
+ *
+ * On success, it returns one and sets |*out| to a newly allocated buffer
+ * containing the result and |*out_len| to its length. The caller must free
+ * |*out| with |OPENSSL_free|. Otherwise, it returns zero.
+ */
+static int encode_pkcs1(unsigned char **out, int *out_len, int type,
+ const unsigned char *m, unsigned int m_len)
{
X509_SIG sig;
- ASN1_TYPE parameter;
- int i, j, ret = 1;
- unsigned char *p, *tmps = NULL;
- const unsigned char *s = NULL;
X509_ALGOR algor;
+ ASN1_TYPE parameter;
ASN1_OCTET_STRING digest;
+ uint8_t *der = NULL;
+ int len;
+
+ sig.algor = &algor;
+ sig.algor->algorithm = OBJ_nid2obj(type);
+ if (sig.algor->algorithm == NULL) {
+ RSAerr(RSA_F_ENCODE_PKCS1, RSA_R_UNKNOWN_ALGORITHM_TYPE);
+ return 0;
+ }
+ if (OBJ_length(sig.algor->algorithm) == 0) {
+ RSAerr(RSA_F_ENCODE_PKCS1,
+ RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
+ return 0;
+ }
+ parameter.type = V_ASN1_NULL;
+ parameter.value.ptr = NULL;
+ sig.algor->parameter = ¶meter;
+
+ sig.digest = &digest;
+ sig.digest->data = (unsigned char *)m;
+ sig.digest->length = m_len;
+
+ len = i2d_X509_SIG(&sig, &der);
+ if (len < 0)
+ return 0;
+
+ *out = der;
+ *out_len = len;
+ return 1;
+}
+
+int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
+ unsigned char *sigret, unsigned int *siglen, RSA *rsa)
+{
+ int encrypt_len, encoded_len = 0, ret = 0;
+ unsigned char *tmps = NULL;
+ const unsigned char *encoded = NULL;
+
if (rsa->meth->rsa_sign) {
return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
}
- /* Special case: SSL signature, just check the length */
+
+ /* Compute the encoded digest. */
if (type == NID_md5_sha1) {
+ /*
+ * NID_md5_sha1 corresponds to the MD5/SHA1 combination in TLS 1.1 and
+ * earlier. It has no DigestInfo wrapper but otherwise is
+ * RSASSA-PKCS1-v1_5.
+ */
if (m_len != SSL_SIG_LENGTH) {
RSAerr(RSA_F_RSA_SIGN, RSA_R_INVALID_MESSAGE_LENGTH);
- return (0);
+ return 0;
}
- i = SSL_SIG_LENGTH;
- s = m;
+ encoded_len = SSL_SIG_LENGTH;
+ encoded = m;
} else {
- sig.algor = &algor;
- sig.algor->algorithm = OBJ_nid2obj(type);
- if (sig.algor->algorithm == NULL) {
- RSAerr(RSA_F_RSA_SIGN, RSA_R_UNKNOWN_ALGORITHM_TYPE);
- return (0);
- }
- if (OBJ_length(sig.algor->algorithm) == 0) {
- RSAerr(RSA_F_RSA_SIGN,
- RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
- return (0);
- }
- parameter.type = V_ASN1_NULL;
- parameter.value.ptr = NULL;
- sig.algor->parameter = ¶meter;
-
- sig.digest = &digest;
- sig.digest->data = (unsigned char *)m; /* TMP UGLY CAST */
- sig.digest->length = m_len;
-
- i = i2d_X509_SIG(&sig, NULL);
+ if (!encode_pkcs1(&tmps, &encoded_len, type, m, m_len))
+ goto err;
+ encoded = tmps;
}
- j = RSA_size(rsa);
- if (i > (j - RSA_PKCS1_PADDING_SIZE)) {
+
+ if (encoded_len > RSA_size(rsa) - RSA_PKCS1_PADDING_SIZE) {
RSAerr(RSA_F_RSA_SIGN, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
- return (0);
- }
- if (type != NID_md5_sha1) {
- tmps = OPENSSL_malloc((unsigned int)j + 1);
- if (tmps == NULL) {
- RSAerr(RSA_F_RSA_SIGN, ERR_R_MALLOC_FAILURE);
- return (0);
- }
- p = tmps;
- i2d_X509_SIG(&sig, &p);
- s = tmps;
+ goto err;
}
- i = RSA_private_encrypt(i, s, sigret, rsa, RSA_PKCS1_PADDING);
- if (i <= 0)
- ret = 0;
- else
- *siglen = i;
-
- if (type != NID_md5_sha1)
- OPENSSL_clear_free(tmps, (unsigned int)j + 1);
- return (ret);
-}
+ encrypt_len = RSA_private_encrypt(encoded_len, encoded, sigret, rsa,
+ RSA_PKCS1_PADDING);
+ if (encrypt_len <= 0)
+ goto err;
-/*
- * Check DigestInfo structure does not contain extraneous data by reencoding
- * using DER and checking encoding against original.
- */
-static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo,
- int dinfolen)
-{
- unsigned char *der = NULL;
- int derlen;
- int ret = 0;
- derlen = i2d_X509_SIG(sig, &der);
- if (derlen <= 0)
- return 0;
- if (derlen == dinfolen && !memcmp(dinfo, der, derlen))
- ret = 1;
- OPENSSL_clear_free(der, derlen);
+ *siglen = encrypt_len;
+ ret = 1;
+
+err:
+ OPENSSL_clear_free(tmps, (size_t)encoded_len);
return ret;
}
-int int_rsa_verify(int dtype, const unsigned char *m,
- unsigned int m_len,
+/*
+ * int_rsa_verify verifies an RSA signature in |sigbuf| using |rsa|. It may be
+ * called in two modes. If |rm| is NULL, it verifies the signature for digest
+ * |m|. Otherwise, it recovers the digest from the signature, writing the digest
+ * to |rm| and the length to |*prm_len|. |type| is the NID of the digest
+ * algorithm to use. It returns one on successful verification and zero
+ * otherwise.
+ */
+int int_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
unsigned char *rm, size_t *prm_len,
const unsigned char *sigbuf, size_t siglen, RSA *rsa)
{
- int i, ret = 0, sigtype;
- unsigned char *s;
- X509_SIG *sig = NULL;
+ int decrypt_len, ret = 0, encoded_len = 0;
+ unsigned char *decrypt_buf = NULL, *encoded = NULL;
- if (siglen != (unsigned int)RSA_size(rsa)) {
+ if (siglen != (size_t)RSA_size(rsa)) {
RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_WRONG_SIGNATURE_LENGTH);
- return (0);
- }
-
- if ((dtype == NID_md5_sha1) && rm) {
- i = RSA_public_decrypt((int)siglen,
- sigbuf, rm, rsa, RSA_PKCS1_PADDING);
- if (i <= 0)
- return 0;
- *prm_len = i;
- return 1;
+ return 0;
}
- s = OPENSSL_malloc((unsigned int)siglen);
- if (s == NULL) {
+ /* Recover the encoded digest. */
+ decrypt_buf = OPENSSL_malloc(siglen);
+ if (decrypt_buf == NULL) {
RSAerr(RSA_F_INT_RSA_VERIFY, ERR_R_MALLOC_FAILURE);
goto err;
}
- if ((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH)) {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
- goto err;
- }
- i = RSA_public_decrypt((int)siglen, sigbuf, s, rsa, RSA_PKCS1_PADDING);
- if (i <= 0)
+ decrypt_len = RSA_public_decrypt((int)siglen, sigbuf, decrypt_buf, rsa,
+ RSA_PKCS1_PADDING);
+ if (decrypt_len <= 0)
goto err;
- /*
- * Oddball MDC2 case: signature can be OCTET STRING. check for correct
- * tag and length octets.
- */
- if (dtype == NID_mdc2 && i == 18 && s[0] == 0x04 && s[1] == 0x10) {
- if (rm) {
- memcpy(rm, s + 2, 16);
- *prm_len = 16;
- ret = 1;
- } else if (memcmp(m, s + 2, 16)) {
+
+ if (type == NID_md5_sha1) {
+ /*
+ * NID_md5_sha1 corresponds to the MD5/SHA1 combination in TLS 1.1 and
+ * earlier. It has no DigestInfo wrapper but otherwise is
+ * RSASSA-PKCS1-v1_5.
+ */
+ if (decrypt_len != SSL_SIG_LENGTH) {
RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
- } else {
- ret = 1;
+ goto err;
}
- } else if (dtype == NID_md5_sha1) {
- /* Special case: SSL signature */
- if ((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH))
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
- else
- ret = 1;
- } else {
- const unsigned char *p = s;
- sig = d2i_X509_SIG(NULL, &p, (long)i);
- if (sig == NULL)
- goto err;
+ if (rm != NULL) {
+ memcpy(rm, decrypt_buf, SSL_SIG_LENGTH);
+ *prm_len = SSL_SIG_LENGTH;
+ } else {
+ if (m_len != SSL_SIG_LENGTH) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
+ goto err;
+ }
- /* Excess data can be used to create forgeries */
- if (p != s + i || !rsa_check_digestinfo(sig, s, i)) {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
- goto err;
+ if (memcmp(decrypt_buf, m, SSL_SIG_LENGTH) != 0) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
+ goto err;
+ }
}
+ } else if (type == NID_mdc2 && decrypt_len == 2 + 16
+ && decrypt_buf[0] == 0x04 && decrypt_buf[1] == 0x10) {
+ /*
+ * Oddball MDC2 case: signature can be OCTET STRING. check for correct
+ * tag and length octets.
+ */
+ if (rm != NULL) {
+ memcpy(rm, decrypt_buf + 2, 16);
+ *prm_len = 16;
+ } else {
+ if (m_len != 16) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
+ goto err;
+ }
+ if (memcmp(m, decrypt_buf + 2, 16) != 0) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
+ goto err;
+ }
+ }
+ } else {
/*
- * Parameters to the signature algorithm can also be used to create
- * forgeries
+ * If recovering the digest, extract a digest-sized output from the end
+ * of |decrypt_buf| for |encode_pkcs1|, then compare the decryption
+ * output as in a standard verification.
*/
- if (sig->algor->parameter
- && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
- goto err;
+ if (rm != NULL) {
+ const EVP_MD *md = EVP_get_digestbynid(type);
+ if (md == NULL) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_UNKNOWN_ALGORITHM_TYPE);
+ goto err;
+ }
+
+ m_len = EVP_MD_size(md);
+ if (m_len > (size_t)decrypt_len) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
+ goto err;
+ }
+ m = decrypt_buf + decrypt_len - m_len;
}
- sigtype = OBJ_obj2nid(sig->algor->algorithm);
+ /* Construct the encoded digest and ensure it matches. */
+ if (!encode_pkcs1(&encoded, &encoded_len, type, m, m_len))
+ goto err;
- if (sigtype != dtype) {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_ALGORITHM_MISMATCH);
+ if (encoded_len != decrypt_len
+ || memcmp(encoded, decrypt_buf, encoded_len) != 0) {
+ RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
goto err;
}
- if (rm) {
- const EVP_MD *md;
- md = EVP_get_digestbynid(dtype);
- if (md && (EVP_MD_size(md) != sig->digest->length))
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
- else {
- memcpy(rm, sig->digest->data, sig->digest->length);
- *prm_len = sig->digest->length;
- ret = 1;
- }
- } else if (((unsigned int)sig->digest->length != m_len) ||
- (memcmp(m, sig->digest->data, m_len) != 0)) {
- RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
- } else
- ret = 1;
+
+ /* Output the recovered digest. */
+ if (rm != NULL) {
+ memcpy(rm, m, m_len);
+ *prm_len = m_len;
+ }
}
- err:
- X509_SIG_free(sig);
- OPENSSL_clear_free(s, (unsigned int)siglen);
- return (ret);
+
+ ret = 1;
+
+err:
+ OPENSSL_clear_free(encoded, (size_t)encoded_len);
+ OPENSSL_clear_free(decrypt_buf, siglen);
+ return ret;
}
-int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
+int RSA_verify(int type, const unsigned char *m, unsigned int m_len,
const unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
{
if (rsa->meth->rsa_verify) {
- return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
+ return rsa->meth->rsa_verify(type, m, m_len, sigbuf, siglen, rsa);
}
- return int_rsa_verify(dtype, m, m_len, NULL, NULL, sigbuf, siglen, rsa);
+ return int_rsa_verify(type, m, m_len, NULL, NULL, sigbuf, siglen, rsa);
}
diff --git a/doc/crypto/RSA_sign.pod b/doc/crypto/RSA_sign.pod
index 64418a5..fbb38d8 100644
--- a/doc/crypto/RSA_sign.pod
+++ b/doc/crypto/RSA_sign.pod
@@ -17,9 +17,9 @@ RSA_sign, RSA_verify - RSA signatures
=head1 DESCRIPTION
RSA_sign() signs the message digest B<m> of size B<m_len> using the
-private key B<rsa> as specified in PKCS #1 v2.0. It stores the
-signature in B<sigret> and the signature size in B<siglen>. B<sigret>
-must point to RSA_size(B<rsa>) bytes of memory.
+private key B<rsa> using RSASSA-PKCS1-v1_5 as specified in RFC 3447. It
+stores the signature in B<sigret> and the signature size in B<siglen>.
+B<sigret> must point to RSA_size(B<rsa>) bytes of memory.
Note that PKCS #1 adds meta-data, placing limits on the size of the
key that can be used.
See L<RSA_private_encrypt(3)> for lower-level
diff --git a/include/openssl/rsa.h b/include/openssl/rsa.h
index 9721218..4d6e9cc 100644
--- a/include/openssl/rsa.h
+++ b/include/openssl/rsa.h
@@ -462,6 +462,7 @@ int ERR_load_RSA_strings(void);
/* Function codes. */
# define RSA_F_CHECK_PADDING_MD 140
+# define RSA_F_ENCODE_PKCS1 146
# define RSA_F_INT_RSA_VERIFY 145
# define RSA_F_OLD_RSA_PRIV_DECODE 147
# define RSA_F_PKEY_RSA_CTRL 143
diff --git a/test/evptests.txt b/test/evptests.txt
index 147c8a4..b0d0992 100644
--- a/test/evptests.txt
+++ b/test/evptests.txt
@@ -2507,6 +2507,23 @@ Ctrl = digest:SHA1
Input = "0123456789ABCDEF1234"
Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+VerifyRecover = RSA-2048
+Ctrl = digest:SHA1
+Input = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+Output = "0123456789ABCDEF1234"
+
+# Leading zero in the signature
+Verify = RSA-2048
+Ctrl = digest:SHA1
+Input = "0123456789ABCDEF1234"
+Output = 00c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+Result = VERIFY_ERROR
+
+VerifyRecover = RSA-2048
+Ctrl = digest:SHA1
+Input = 00c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+Result = KEYOP_ERROR
+
# Digest too long
Sign = RSA-2048
Ctrl = digest:SHA1
@@ -2535,11 +2552,12 @@ Input = "0123456789ABCDEF1233"
Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ae
Result = VERIFY_ERROR
-# parameter is not NULL: should verify OK
+# parameter is not NULL
Verify = RSA-2048
Ctrl = digest:sha1
Input = "0123456789ABCDEF1234"
Output = 3ec3fc29eb6e122bd7aa361cd09fe1bcbe85311096a7b9e4799cedfb2351ce0ab7fe4e75b4f6b37f67edd9c60c800f9ab941c0c157d7d880ca9de40c951d60fd293ae220d4bc510b1572d6e85a1bbbd8605b52e05f1c64fafdae59a1c2fbed214b7844d0134619de62851d5a0522e32e556e5950f3f97b8150e3f0dffee612c924201c27cd9bc8b423a71533380c276d3d59fcba35a2e80a1a192ec266a6c2255012cd86a349fe90a542b355fa3355b04da6cdf1df77f0e7bd44a90e880e1760266d233e465226f5db1c68857847d82072861ee266ddfc2e596845b77e1803274a579835ab5e4975d81d20b7df9cec7795489e4a2bdb8c1cf6a6b359945ac92c
+Result = VERIFY_ERROR
# embedded digest too long
Verify = RSA-2048
@@ -2548,6 +2566,11 @@ Input = "0123456789ABCDEF1234"
Output = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
Result = VERIFY_ERROR
+VerifyRecover = RSA-2048
+Ctrl = digest:sha1
+Input = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
+Result = KEYOP_ERROR
+
# embedded digest too short
Verify = RSA-2048
Ctrl = digest:sha1
@@ -2555,6 +2578,11 @@ Input = "0123456789ABCDEF1234"
Output = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
Result = VERIFY_ERROR
+VerifyRecover = RSA-2048
+Ctrl = digest:sha1
+Input = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
+Result = KEYOP_ERROR
+
# Garbage after DigestInfo
Verify = RSA-2048
Ctrl = digest:sha1
@@ -2562,6 +2590,11 @@ Input = "0123456789ABCDEF1234"
Output = 9ee34872d4271a7d8808af0a4052a145a6d6a8437d00da3ed14428c7f087cd39f4d43334c41af63e7fa1ba363fee7bcef401d9d36a662abbab55ce89a696e1be0dfa19a5d09ca617dd488787b6048baaefeb29bc8688b2fe3882de2b77c905b5a8b56cf9616041e5ec934ba6de863efe93acc4eef783fe7f72a00fa65d6093ed32bf98ce527e62ccb1d56317f4be18b7e0f55d7c36617d2d0678a306e3350956b662ac15df45215dd8f6b314babb9788e6c272fa461e4c9b512a11a4b92bc77c3a4c95c903fccb238794eca5c750477bf56ea6ee6a167367d881b485ae3889e7c489af8fdf38e0c0f2aed780831182e34abedd43c39281b290774bf35cc25274
Result = VERIFY_ERROR
+VerifyRecover = RSA-2048
+Ctrl = digest:sha1
+Input = 9ee34872d4271a7d8808af0a4052a145a6d6a8437d00da3ed14428c7f087cd39f4d43334c41af63e7fa1ba363fee7bcef401d9d36a662abbab55ce89a696e1be0dfa19a5d09ca617dd488787b6048baaefeb29bc8688b2fe3882de2b77c905b5a8b56cf9616041e5ec934ba6de863efe93acc4eef783fe7f72a00fa65d6093ed32bf98ce527e62ccb1d56317f4be18b7e0f55d7c36617d2d0678a306e3350956b662ac15df45215dd8f6b314babb9788e6c272fa461e4c9b512a11a4b92bc77c3a4c95c903fccb238794eca5c750477bf56ea6ee6a167367d881b485ae3889e7c489af8fdf38e0c0f2aed780831182e34abedd43c39281b290774bf35cc25274
+Result = KEYOP_ERROR
+
# invalid tag for parameter
Verify = RSA-2048
Ctrl = digest:sha1
@@ -2569,6 +2602,110 @@ Input = "0123456789ABCDEF1234"
Output = 49525db4d44c755e560cba980b1d85ea604b0e077fcadd4ba44072a3487bbddb835016200a7d8739cce2dc3223d9c20cbdd25059ab02277f1f21318efd18e21038ec89aa9d40680987129e8b41ba33bceb86518bdf47268b921cce2037acabca6575d832499538d6f40cdba0d40bd7f4d8ea6ca6e2eec87f294efc971407857f5d7db09f6a7b31e301f571c6d82a5e3d08d2bb3a36e673d28b910f5bec57f0fcc4d968fd7c94d0b9226dec17f5192ad8b42bcab6f26e1bea1fdc3b958199acb00f14ebcb2a352f3afcedd4c09000128a603bbeb9696dea13040445253972d46237a25c7845e3b464e6984c2348ea1f1210a9ff0b00d2d72b50db00c009bb39f9
Result = VERIFY_ERROR
+VerifyRecover = RSA-2048
+Ctrl = digest:sha1
+Input = 49525db4d44c755e560cba980b1d85ea604b0e077fcadd4ba44072a3487bbddb835016200a7d8739cce2dc3223d9c20cbdd25059ab02277f1f21318efd18e21038ec89aa9d40680987129e8b41ba33bceb86518bdf47268b921cce2037acabca6575d832499538d6f40cdba0d40bd7f4d8ea6ca6e2eec87f294efc971407857f5d7db09f6a7b31e301f571c6d82a5e3d08d2bb3a36e673d28b910f5bec57f0fcc4d968fd7c94d0b9226dec17f5192ad8b42bcab6f26e1bea1fdc3b958199acb00f14ebcb2a352f3afcedd4c09000128a603bbeb9696dea13040445253972d46237a25c7845e3b464e6984c2348ea1f1210a9ff0b00d2d72b50db00c009bb39f9
+Result = KEYOP_ERROR
+
+# MD5/SHA-1 combination
+Verify = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = "0123456789ABCDEF0123456789ABCDEF0123"
+Output = 7b80e0d4d2a6b7f4b018ce164bc0be21a0604b1b05e91c6204372458b05a0e4dbf0b36b3f80dbf04b278ad1fcf7ff6d982d5ca5d98b13b68240d846d400b8db6675b1a5fcbe2256322c5f691378bc941785326030fa835d240e334e2a4d35b17c1149b59dbb6e6d53b44326ebfc371f754449d36bad3722c1878af1699bb0a00c28e37162f99aba550b7c333228a70c906e3701c519a460a14fac29ff164ca9413efd19b431b31a9ad2988662cdbda9cdcff85f294b4be2cf072caceb1d3f52642edafea2e1d1e495061f18b5b3a130d2242cec830e44d506590e5df69bb974879a35e6bdc1ad00e3e31b362f2f5cdeabd8a0dfddfdb66a7c43993a3e189b80d
+
+VerifyRecover = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = 7b80e0d4d2a6b7f4b018ce164bc0be21a0604b1b05e91c6204372458b05a0e4dbf0b36b3f80dbf04b278ad1fcf7ff6d982d5ca5d98b13b68240d846d400b8db6675b1a5fcbe2256322c5f691378bc941785326030fa835d240e334e2a4d35b17c1149b59dbb6e6d53b44326ebfc371f754449d36bad3722c1878af1699bb0a00c28e37162f99aba550b7c333228a70c906e3701c519a460a14fac29ff164ca9413efd19b431b31a9ad2988662cdbda9cdcff85f294b4be2cf072caceb1d3f52642edafea2e1d1e495061f18b5b3a130d2242cec830e44d506590e5df69bb974879a35e6bdc1ad00e3e31b362f2f5cdeabd8a0dfddfdb66a7c43993a3e189b80d
+Output = "0123456789ABCDEF0123456789ABCDEF0123"
+
+# MD5/SHA-1 combination, digest mismatch
+Verify = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = "000000000000000000000000000000000000"
+Output = 7b80e0d4d2a6b7f4b018ce164bc0be21a0604b1b05e91c6204372458b05a0e4dbf0b36b3f80dbf04b278ad1fcf7ff6d982d5ca5d98b13b68240d846d400b8db6675b1a5fcbe2256322c5f691378bc941785326030fa835d240e334e2a4d35b17c1149b59dbb6e6d53b44326ebfc371f754449d36bad3722c1878af1699bb0a00c28e37162f99aba550b7c333228a70c906e3701c519a460a14fac29ff164ca9413efd19b431b31a9ad2988662cdbda9cdcff85f294b4be2cf072caceb1d3f52642edafea2e1d1e495061f18b5b3a130d2242cec830e44d506590e5df69bb974879a35e6bdc1ad00e3e31b362f2f5cdeabd8a0dfddfdb66a7c43993a3e189b80d
+Result = VERIFY_ERROR
+
+# MD5/SHA-1 combination, wrong signature digest length
+Verify = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = "0123456789ABCDEF0123456789ABCDEF0123"
+Output = 6c13511f97ffb8137545fce551a43cf2b5b3dbdd5c3ceaaccd4620a6a373f3c38cc523d95bbdd810c852743b981bc4393c6b0cdfb0da5e77a8cc0108b05ff95e0f4dd7a0125b7390af1408dca6ddefac3b05b768de7b0c3df3c74e5f102f62743d67813beee1777036078da4cff5b29f49f01a6df3a2e709c37a83737108517687fe754d9ee908cb36c55e88f67c0b537108707347d16049f5dfac3d400ea367222d36627937a7f822f451c3d2c2dbc9e2202bffd3dc1b22213e17270a6b657619c6f44cbf66b077d548cfc9e1a114f8b853412470f2bf8d828f04d0d9f1aef260d216acb0911329fb5bdc48c2be3b198bf6f96e1c3fb116ad4430140d0640d4
+Result = VERIFY_ERROR
+
+VerifyRecover = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = 6c13511f97ffb8137545fce551a43cf2b5b3dbdd5c3ceaaccd4620a6a373f3c38cc523d95bbdd810c852743b981bc4393c6b0cdfb0da5e77a8cc0108b05ff95e0f4dd7a0125b7390af1408dca6ddefac3b05b768de7b0c3df3c74e5f102f62743d67813beee1777036078da4cff5b29f49f01a6df3a2e709c37a83737108517687fe754d9ee908cb36c55e88f67c0b537108707347d16049f5dfac3d400ea367222d36627937a7f822f451c3d2c2dbc9e2202bffd3dc1b22213e17270a6b657619c6f44cbf66b077d548cfc9e1a114f8b853412470f2bf8d828f04d0d9f1aef260d216acb0911329fb5bdc48c2be3b198bf6f96e1c3fb116ad4430140d0640d4
+Result = KEYOP_ERROR
+
+# MD5/SHA-1 combination, wrong input digest length
+Verify = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = "0123456789ABCDEF0123456789ABCDEF012"
+Output = 7b80e0d4d2a6b7f4b018ce164bc0be21a0604b1b05e91c6204372458b05a0e4dbf0b36b3f80dbf04b278ad1fcf7ff6d982d5ca5d98b13b68240d846d400b8db6675b1a5fcbe2256322c5f691378bc941785326030fa835d240e334e2a4d35b17c1149b59dbb6e6d53b44326ebfc371f754449d36bad3722c1878af1699bb0a00c28e37162f99aba550b7c333228a70c906e3701c519a460a14fac29ff164ca9413efd19b431b31a9ad2988662cdbda9cdcff85f294b4be2cf072caceb1d3f52642edafea2e1d1e495061f18b5b3a130d2242cec830e44d506590e5df69bb974879a35e6bdc1ad00e3e31b362f2f5cdeabd8a0dfddfdb66a7c43993a3e189b80d
+Result = VERIFY_ERROR
+
+# MD5/SHA-1 combination, wrong input and signature digest length
+Verify = RSA-2048
+Ctrl = digest:MD5-SHA1
+Input = "0123456789ABCDEF0123456789ABCDEF012"
+Output = 6c13511f97ffb8137545fce551a43cf2b5b3dbdd5c3ceaaccd4620a6a373f3c38cc523d95bbdd810c852743b981bc4393c6b0cdfb0da5e77a8cc0108b05ff95e0f4dd7a0125b7390af1408dca6ddefac3b05b768de7b0c3df3c74e5f102f62743d67813beee1777036078da4cff5b29f49f01a6df3a2e709c37a83737108517687fe754d9ee908cb36c55e88f67c0b537108707347d16049f5dfac3d400ea367222d36627937a7f822f451c3d2c2dbc9e2202bffd3dc1b22213e17270a6b657619c6f44cbf66b077d548cfc9e1a114f8b853412470f2bf8d828f04d0d9f1aef260d216acb0911329fb5bdc48c2be3b198bf6f96e1c3fb116ad4430140d0640d4
+Result = VERIFY_ERROR
+
+# DigestInfo-wrapped MDC-2 signature
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0123456789ABCDEF"
+Output = 3a46e5e80635d3b5586187b44b08fd02ca0bd36a637a8afeb46a1c1eb18d05b3196e00edf85378109015bcd3d0cfcefc2919c5b8e3ac42884b360188b1395ed34df7d2749f36b91c320d290311d78b36f390481eff42ace0275385c05176d022e4b625cf0ed85082d4b25da9e8a86011f6ac1cb8d8b812cc2bbd6c240caa8445aa74f8e971c935dbf3447df0411eb9e5cdee0851d1e0fea7041916c77efc09dc54e8dd4b7ba8f8d85ef43d4f12abde99886f4ebd5f021fc1b476cc23dc6a94fbbe77c954eee496fb6b4b5c534daa4e819143ce8de511a8bcb65759750c17edaca6fb31ac271c1ca3a27705f780ae86c67009e76fcba9067dde3556ff59c44111
+
+VerifyRecover = RSA-2048
+Ctrl = digest:MDC2
+Input = 3a46e5e80635d3b5586187b44b08fd02ca0bd36a637a8afeb46a1c1eb18d05b3196e00edf85378109015bcd3d0cfcefc2919c5b8e3ac42884b360188b1395ed34df7d2749f36b91c320d290311d78b36f390481eff42ace0275385c05176d022e4b625cf0ed85082d4b25da9e8a86011f6ac1cb8d8b812cc2bbd6c240caa8445aa74f8e971c935dbf3447df0411eb9e5cdee0851d1e0fea7041916c77efc09dc54e8dd4b7ba8f8d85ef43d4f12abde99886f4ebd5f021fc1b476cc23dc6a94fbbe77c954eee496fb6b4b5c534daa4e819143ce8de511a8bcb65759750c17edaca6fb31ac271c1ca3a27705f780ae86c67009e76fcba9067dde3556ff59c44111
+Output = "0123456789ABCDEF"
+
+# Legacy OCTET STRING MDC-2 signature
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0123456789ABCDEF"
+Output = 6cde46bbfc6a3b772c3d884640709be9f2fb70fcf199c14eaff7811369ea99733f984a9c48cd372578fa37cedeef24c93286d6d64f438df051e625ab2e125a7d9974a76240873e43efc3acbcbdccc2ee63769cdbf983b334ccb982273315c222b3bbdc3e928ac8a141a7412f1f794cfcabcc069a2ae4975d7bb68bea145d789634c9e0b02d324b5efd599c9bf2b1d32d077aba59aa0ad4a82cbbb90eaa9214e4f57104cf049c4139e2ddecf6edf219cd986f4d79cf25128c58667562c9d22be0291430d6cc7dad977d56e08315fcec133ea95d8db550f89735b4d5f233eaff0c86fce2b99f3f508e920f882c31f3e13f8775a3c8fa585c4f4c69eca89f648b7e
+
+VerifyRecover = RSA-2048
+Ctrl = digest:MDC2
+Input = 6cde46bbfc6a3b772c3d884640709be9f2fb70fcf199c14eaff7811369ea99733f984a9c48cd372578fa37cedeef24c93286d6d64f438df051e625ab2e125a7d9974a76240873e43efc3acbcbdccc2ee63769cdbf983b334ccb982273315c222b3bbdc3e928ac8a141a7412f1f794cfcabcc069a2ae4975d7bb68bea145d789634c9e0b02d324b5efd599c9bf2b1d32d077aba59aa0ad4a82cbbb90eaa9214e4f57104cf049c4139e2ddecf6edf219cd986f4d79cf25128c58667562c9d22be0291430d6cc7dad977d56e08315fcec133ea95d8db550f89735b4d5f233eaff0c86fce2b99f3f508e920f882c31f3e13f8775a3c8fa585c4f4c69eca89f648b7e
+Output = "0123456789ABCDEF"
+
+# Legacy OCTET STRING MDC-2 signature, digest mismatch
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0000000000000000"
+Output = 6cde46bbfc6a3b772c3d884640709be9f2fb70fcf199c14eaff7811369ea99733f984a9c48cd372578fa37cedeef24c93286d6d64f438df051e625ab2e125a7d9974a76240873e43efc3acbcbdccc2ee63769cdbf983b334ccb982273315c222b3bbdc3e928ac8a141a7412f1f794cfcabcc069a2ae4975d7bb68bea145d789634c9e0b02d324b5efd599c9bf2b1d32d077aba59aa0ad4a82cbbb90eaa9214e4f57104cf049c4139e2ddecf6edf219cd986f4d79cf25128c58667562c9d22be0291430d6cc7dad977d56e08315fcec133ea95d8db550f89735b4d5f233eaff0c86fce2b99f3f508e920f882c31f3e13f8775a3c8fa585c4f4c69eca89f648b7e
+Result = VERIFY_ERROR
+
+# Legacy OCTET STRING MDC-2 signature, wrong input digest length
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0123456789ABCDE"
+Output = 6cde46bbfc6a3b772c3d884640709be9f2fb70fcf199c14eaff7811369ea99733f984a9c48cd372578fa37cedeef24c93286d6d64f438df051e625ab2e125a7d9974a76240873e43efc3acbcbdccc2ee63769cdbf983b334ccb982273315c222b3bbdc3e928ac8a141a7412f1f794cfcabcc069a2ae4975d7bb68bea145d789634c9e0b02d324b5efd599c9bf2b1d32d077aba59aa0ad4a82cbbb90eaa9214e4f57104cf049c4139e2ddecf6edf219cd986f4d79cf25128c58667562c9d22be0291430d6cc7dad977d56e08315fcec133ea95d8db550f89735b4d5f233eaff0c86fce2b99f3f508e920f882c31f3e13f8775a3c8fa585c4f4c69eca89f648b7e
+Result = VERIFY_ERROR
+
+# Legacy OCTET STRING MDC-2 signature, wrong signature digest length
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0123456789ABCDEF"
+Output = 08da512483ece70be57f28a75271612800ae30ffbadc62609bc88b80d497a1fc13c300fdfcab6dc80cf55373c10adcc249ae80479b87fa3e391a2cd4a74babd1c22a4976812d544dcd6729b161bbc48fd067cf635b05f9edaddaeb6f67f2117d6b54a23c5e6f08a246abfe0356a67d7f3929306515e6d9962f8ce205120ecdcd2d4e3783cd0b4a1f0196a1b13924d0d3649233312695c3c336ae04e0b1efddabcc878b57622db60f6f747a1124c38426dacf1425c92d304c2bb1052f987c1dd73e4cc4b20d23396d4f05f52f98cf5065c3fb7dc319425f1f6f1878b87f57afbd24fbff98909494581aadd04d80a639b85ce8684ea58409d8dbbbaacf256bb5c4
+Result = VERIFY_ERROR
+
+VerifyRecover = RSA-2048
+Ctrl = digest:MDC2
+Input = 08da512483ece70be57f28a75271612800ae30ffbadc62609bc88b80d497a1fc13c300fdfcab6dc80cf55373c10adcc249ae80479b87fa3e391a2cd4a74babd1c22a4976812d544dcd6729b161bbc48fd067cf635b05f9edaddaeb6f67f2117d6b54a23c5e6f08a246abfe0356a67d7f3929306515e6d9962f8ce205120ecdcd2d4e3783cd0b4a1f0196a1b13924d0d3649233312695c3c336ae04e0b1efddabcc878b57622db60f6f747a1124c38426dacf1425c92d304c2bb1052f987c1dd73e4cc4b20d23396d4f05f52f98cf5065c3fb7dc319425f1f6f1878b87f57afbd24fbff98909494581aadd04d80a639b85ce8684ea58409d8dbbbaacf256bb5c4
+Result = KEYOP_ERROR
+
+# Legacy OCTET STRING MDC-2 signature, wrong input and signature digest length
+Verify = RSA-2048
+Ctrl = digest:MDC2
+Input = "0123456789ABCDE"
+Output = 08da512483ece70be57f28a75271612800ae30ffbadc62609bc88b80d497a1fc13c300fdfcab6dc80cf55373c10adcc249ae80479b87fa3e391a2cd4a74babd1c22a4976812d544dcd6729b161bbc48fd067cf635b05f9edaddaeb6f67f2117d6b54a23c5e6f08a246abfe0356a67d7f3929306515e6d9962f8ce205120ecdcd2d4e3783cd0b4a1f0196a1b13924d0d3649233312695c3c336ae04e0b1efddabcc878b57622db60f6f747a1124c38426dacf1425c92d304c2bb1052f987c1dd73e4cc4b20d23396d4f05f52f98cf5065c3fb7dc319425f1f6f1878b87f57afbd24fbff98909494581aadd04d80a639b85ce8684ea58409d8dbbbaacf256bb5c4
+Result = VERIFY_ERROR
+
# Verify using public key
Verify = RSA-2048-PUBLIC
More information about the openssl-commits
mailing list