832784 - Verification of digital signature created with A-Trust e-Card G3 fails in Thunderbird

Status: RESOLVED INVALID

(MailNews Core :: Security: S/MIME, defect)

Description

[michfasch]

Attachment: sign_only.eml

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130116073211

Steps to reproduce:

I signed an email (addressed to myself) using Thunderbird's built-in S/MIME signing.
I used the crypto-module asignp11.dll provided by a-trust.at (part of the a.sign client, can be downloaded here: https://www.a-trust.at/downloads/Client/ASignClient.asp ).


Actual results:

There was no problem reported when signing/sending the message. When I received the message, Thunderbird told me that the signature was invalid:
This message includes a digital signature, but the signature is invalid.
The signature does not match the message content correctly. The message appears to have been altered after the sender signed it.


Expected results:

Since the message has not been altered, the signature should have been verified correctly.

Comment 1

[Kaspar]

(In reply to michfasch from comment #0)
> I used the crypto-module asignp11.dll provided by a-trust.at

What version did you use (1.3.1.15, as reported at https://forum.a-trust.at/viewtopic.php?t=4443#p1037192)? If so, did you try to upgrade to the current release?

The problem with the signature in the message in attachment 704344 [details] is that the proper PKCS#1 v1.5 encoding is missing - the signature block only includes the raw SHA-1 digest, but not the DigestInfo wrapper as specified in the PKCS#1 standard, section 9.2 (step 2). Usually Thunderbird will add this wrapper when needed, but it looks like it had problems in figuring out the proper key type in your case (http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/cryptohi/secsign.c?mark=168-192#145).

The release notes for the a.sign client actually explicitly state that version 1.3.1.21 fixes a bug with the PKCS#1 padding:

> Version 1.3.1.21 (2012-10-31)
> [...]
> - Fehler im PKCS#1 Padding bei eCardG3 behoben

(If the problem still exists with 1.3.1.25, then we might need additional debug info.)

Comment 2

[michfasch]

Thanks a lot for your help. Indeed, it was not a Thunderbird problem but a problem with a.sign client. After updating to version 1.3.1.26, both signing and encrypting work.

Comment 3

[Kaspar]

(In reply to michfasch from comment #2)
> Indeed, it was not a Thunderbird problem but a problem with a.sign client.

Yes, it clearly demonstrates that A-Trust's code in 1.3.1.15 was undoubtedly broken: when specifying CKM_RSA_PKCS as the method with C_SignInit, the PKCS#11 module must sign the data supplied with C_Sign AS IS - and certainly not strip (nor add) any DigestInfo wrapper.

> After updating to version 1.3.1.26, both signing and encrypting work.

In the future, when submitting reports to bugzilla.mozilla.org, please make sure to follow https://developer.mozilla.org/en-US/docs/Mozilla/QA/Bug_writing_guidelines. In particular: specify what version of what software exactly you are using, and try to make sure the summary as precise as possible ("digital signature created with Thunderbird" is way too unspecific).