343716 - crypto.signText unable to sign binary data - proposal: usage of base64 for transport

Status: RESOLVED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Oliver Welter]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060510 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060510 Firefox/1.5.0.3

This is more an RFE than a bug.

I need to create a PKCS#7 signature for binary data - it seems that crypto.signText can not handle some special chars (\0, etc) so the signature is invalid.
Proposal: Enable passing the data to sign as a base64 (or hex) encoded block, decode it internally and sign it.

Sidenote: Selection of hashing algorithm might be nice....

For Debugging purposes it would be even a good idea to output the calculated hash.

Reproducible: Always

Steps to Reproduce:
1. call crypto.signText with data containing special chars (e.g. ascii < 30)
2. try to verify the signature
3. analyse with object parser shows that the calculated hash is wrong

Actual Results:  
hash calculation is wrong

Expected Results:  
verifiable signature

Comment 1

[Jose Vano]

In my opinion, this bug should be marked as "invalid" because it's not a bug.

Oliver, if you want the user to sign "binary data" (like a binary file), just call crypto.signText with the sha1 hash of the binary data, for example:

crypto.signText('SHA1=411fabf45976c6fbde546771fd4c7b90b246832f','ask')

Or call crypto.signText with the base64 of the binary data, for example:

crypto.signText('aGVsbG8=','ask')


Please, keep in mind that crypto.signText is intended to sign PLAIN TEXT.

Comment 2

[Kai Engert [:KaiE:]]

I agree with comment 1.

The user should be able to see what she is asked to sign, and presentation of binary data is difficult, and at the very least is not obtended through the UI attached to this interface.

If you really need to sign binary data, we would have to implement a new signing function, and a new convincing User Interface.