From 8386f1dba04dfefbcd8d14065c4d4f3635c12fc2 Mon Sep 17 00:00:00 2001
From: asraa <asraa@google.com>
Date: Tue, 1 Feb 2022 11:36:10 -0600
Subject: [PATCH] fix minisign prehashed entries (#639)
Signed-off-by: Asra Ali <asraa@google.com>
---
go.mod | 5 +++--
go.sum | 11 ++++++-----
pkg/pki/minisign/minisign.go | 12 ++++++++++++
pkg/pki/minisign/minisign_test.go | 1 +
.../minisign/testdata/hello_world_hashed.txt.minisig | 4 ++++
pkg/pki/minisign/testdata/minisign_hashed.pub | 2 ++
6 files changed, 28 insertions(+), 7 deletions(-)
create mode 100644 pkg/pki/minisign/testdata/hello_world_hashed.txt.minisig
create mode 100644 pkg/pki/minisign/testdata/minisign_hashed.pub
diff --git a/go.mod b/go.mod
index b032d4b..e28b0c3 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
github.com/google/rpmpack v0.0.0-20210518075352-dc539ef4f2ea
github.com/google/trillian v1.4.0
github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
- github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431
+ github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mediocregopher/radix/v4 v4.0.0
github.com/mitchellh/go-homedir v1.1.0
@@ -49,10 +49,11 @@ require (
go.uber.org/goleak v1.1.12
go.uber.org/zap v1.20.0
gocloud.dev v0.24.1-0.20211119014450-028788aaaa4c
- golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b
+ golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838
golang.org/x/mod v0.5.1
golang.org/x/net v0.0.0-20211208012354-db4efeb81f4b
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
golang.org/x/tools v0.1.7 // indirect
google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa
google.golang.org/grpc v1.44.0
diff --git a/go.sum b/go.sum
index bd5d5bc..2f6fbab 100644
--- a/go.sum
+++ b/go.sum
@@ -1002,8 +1002,8 @@ github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod
github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 h1:zqyV5j9xEuPQw2ma4RzzS9O74UwTq3vcMmpoHyL6xlI=
-github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431/go.mod h1:3VIJLjlf5Iako82IX/5KOoCzDmogK5mO+bl+DRItnR8=
+github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b h1:ZGiXF8sz7PDk6RgkP+A/SFfUD0ZR/AgG6SpRNEDKZy8=
+github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b/go.mod h1:hQmNrgofl+IY/8L+n20H6E6PWBBTokdsv+q49j0QhsU=
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
@@ -1660,15 +1660,15 @@ golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPh
golang.org/x/crypto v0.0.0-20200930160638-afb6bcd081ae/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20211115234514-b4de73f9ece8/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20211202192323-5770296d904e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b h1:QAqMVf3pSa6eeTsuklijukjXBlj7Es2QQplab+/RbQ4=
golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838 h1:71vQrMauZZhcTVK6KdYM+rklehEEwb3E+ZhaE5jrPrE=
+golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1946,8 +1946,9 @@ golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 h1:XfKQ4OlFl8okEOr5UvAqFRVj8pY/4yfcXrddB8qAbU0=
golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
diff --git a/pkg/pki/minisign/minisign.go b/pkg/pki/minisign/minisign.go
index 3b210b1..666bf16 100644
--- a/pkg/pki/minisign/minisign.go
+++ b/pkg/pki/minisign/minisign.go
@@ -24,6 +24,7 @@ import (
minisign "github.com/jedisct1/go-minisign"
sigsig "github.com/sigstore/sigstore/pkg/signature"
+ "golang.org/x/crypto/blake2b"
)
// Signature Signature that follows the minisign standard; supports both minisign and signify generated signatures
@@ -102,6 +103,17 @@ func (s Signature) Verify(r io.Reader, k interface{}, opts ...sigsig.VerifyOptio
if err != nil {
return err
}
+
+ prehashed := s.signature.SignatureAlgorithm[1] == 0x44
+ if prehashed {
+ h, _ := blake2b.New512(nil)
+ _, err := io.Copy(h, r)
+ if err != nil {
+ return fmt.Errorf("reading minisign data")
+ }
+ r = bytes.NewReader(h.Sum(nil))
+ }
+
return verifier.VerifySignature(bytes.NewReader(s.signature.Signature[:]), r)
}
diff --git a/pkg/pki/minisign/minisign_test.go b/pkg/pki/minisign/minisign_test.go
index 40d38a8..bb948c2 100644
--- a/pkg/pki/minisign/minisign_test.go
+++ b/pkg/pki/minisign/minisign_test.go
@@ -302,6 +302,7 @@ func TestVerifySignature(t *testing.T) {
tests := []test{
{caseDesc: "Valid Signature (minisign), Valid Key", dataFile: "testdata/hello_world.txt", sigFile: "testdata/hello_world.txt.minisig", keyFile: "testdata/minisign.pub", verified: true},
+ {caseDesc: "Valid Signature (minisign, prehashed), Valid Key", dataFile: "testdata/hello_world.txt", sigFile: "testdata/hello_world_hashed.txt.minisig", keyFile: "testdata/minisign_hashed.pub", verified: true},
{caseDesc: "Valid Signature (signify), Valid Key", dataFile: "testdata/hello_world.txt", sigFile: "testdata/hello_world.txt.signify", keyFile: "testdata/signify.pub", verified: true},
{caseDesc: "Valid Signature, Incorrect Key", dataFile: "testdata/hello_world.txt", sigFile: "testdata/hello_world.txt.minisig", keyFile: "testdata/signify.pub", verified: false},
{caseDesc: "Data does not match Signature", dataFile: "testdata/signify.pub", sigFile: "testdata/hello_world.txt.minisig", keyFile: "testdata/minisign.pub", verified: false},
diff --git a/pkg/pki/minisign/testdata/hello_world_hashed.txt.minisig b/pkg/pki/minisign/testdata/hello_world_hashed.txt.minisig
new file mode 100644
index 0000000..eaf4250
--- /dev/null
+++ b/pkg/pki/minisign/testdata/hello_world_hashed.txt.minisig
@@ -0,0 +1,4 @@
+untrusted comment: signature from minisign secret key
+RURIeCI9VBgUB9kPHyUwRtxZycb78g9wT6d+oRuXEKquv665OMM6CI64Z+hGcKiJg2ErfA50FCgmdiUw4EHErNMivjYajjO4EAQ=
+trusted comment: timestamp:1643685548 file:hello_world.txt hashed
+cueBI9ab3mX+ZGQoBFSq49wrxZMTrLjX1Q0LlNhUmnA7dIptKj/KrpbfDJDCPtbxd3lbeo0zKGVNwpW/EQo3Dw==
diff --git a/pkg/pki/minisign/testdata/minisign_hashed.pub b/pkg/pki/minisign/testdata/minisign_hashed.pub
new file mode 100644
index 0000000..fa68889
--- /dev/null
+++ b/pkg/pki/minisign/testdata/minisign_hashed.pub
@@ -0,0 +1,2 @@
+untrusted comment: minisign public key 71418543D227848
+RWRIeCI9VBgUB0FAABABUrdfRVLBsRhOC63S9bDOAeWkCmnT38a1sUDb
\ No newline at end of file
--
GitLab