1755092 - rework signature verification in mozilla::pkix and add tests

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement)

Description

[Dana Keeler (she/her) [:keeler]]

mozilla::pkix separates signature verification into two steps: computing the digest of the signed data, and then verifying the signature against the digest. This adds some complexity that the VFY_* APIs hide, but that implementation is in need of improvement (for one, the digest versions of those APIs doesn't support RSA-PSS, which we will need soon). We can avoid that complexity and the shortcomings in the implementation by using PK11_Verify* directly and not pre-computing digests.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1755092 - rework signature verification in mozilla::pkix r?jschanck

The initial implementation of mozilla::pkix split signature verification into
two steps: digesting the data that had been signed and then verifying that
digest. This separation added complexity when moving from mozilla::pkix to the
concrete signature verification code in NSS. The VFY_* APIs hide this
complexity, but those APIs are in need of improvements. This patch avoids using
the VFY_* APIs as well as the additional complexity by removing the separate
digest step and using the PK11_Verify* APIs directly.

Comment 2

[Dana Keeler (she/her) [:keeler]]

https://hg.mozilla.org/projects/nss/rev/be8a62f85be78cf111aca7cced2d6ad931a1acd1