Interoperability issue with PKCS#1 v1.5 signature verification

[cmcqueen]

I am trying to use this crate to verify a PKCS#1 v1.5 signature that was created with Python pycryptodome.

The following Python + pycryptodome example code successfully verifies a PKCS#1 v1.5 signature for a message:

from base64 import b64decode
from Crypto.Hash import SHA256
from Crypto.PublicKey import RSA
from Crypto.Signature import pkcs1_15 as pkcs1_15_sign

def main():
 public_key_pem = """-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzyaAz9Ak2ruY/9npoZ11
 S4SwZpw6Qx/4nk09xZh4nLsxEjXfXYZBzyLwLnEr040h6ZoGp4zOjAeBK+AsF2ev
 6hNLktwmF7xOXA0VtlTIXX3zl96Xax4ffeEy0uoyggGI9JvH+d+Zvb07OvAbn9js
 xEKVW2CUWHq9vHWUgB5mNf2B3iLj52NAjupiwyb7MfmnCCSWyjuJha428Vdsk4py
 iHn3k0Z1drI3kda9x21X5EfAkdsfm++FFJ5VpB7mRpGT3qg0zX9MtID8N0ZlTYCd
 7ZRlV2tPTOlOdH34tEUShESieKQBrUyxc0IT5wngxd3O6ZJ5CCLzGc4XSAeXkp8t
 9QIDAQAB
 -----END PUBLIC KEY-----"""
 signature64 = (
 "jdTNMwoSCf5bJWeCkKve5kOdKkuLtRokcItjLHEwGRcCnmmTChk6qmopKPdiGvJL"
 "w3iJfGHSh2Z71yERX35m/RVLvkbnnYQtssKFVDj49ttnDXkK/pcPLdbnWc2GPbLN"
 "v5XIpgiR2FPyp2PGbwYDoYNFnOI4ICJSBfKLjjYECCGbKKj4w5QBGzXyiCL0gV6l"
 "iS/7Wj1BCjwDb09FJF3oLGM5kpQlP3r1Ksh38cxsdUbBA/+29TOYclGEqw8VwgT9"
 "s66tTm8sylPTu/4vTFmaHBPiLNOOE9SUl4+zU2GjpqVNtVfj66f/Lm0x1lS8qaxt"
 "AY7y2KV0G5RvDkykZ7y3Yw==")
 message = b"0x59bd329d"

 # Decode base-64 signature
 signature = b64decode(signature64)

 # Calculate SHA256 hash of the message.
 message_hash = SHA256.new(message)

 # Import the public key PEM.
 public_key = RSA.importKey(public_key_pem)
 pub_verifier = pkcs1_15_sign.new(public_key)

 try:
 pub_verifier.verify(message_hash, signature)
 except Exception:
 print("Failed")
 else:
 print("Verified")

if __name__ == "__main__":
 main()

The following Rust code, using rsa v0.7.2, I think is equivalent, but fails the verification:

use base64ct::{Base64, Encoding};
use rsa::{
 pkcs1v15::Signature, pkcs1v15::VerifyingKey, pkcs8::DecodePublicKey, signature::Verifier,
};
use sha2::Sha256;

fn main() {
 let public_key_pem = "-----BEGIN PUBLIC KEY-----\n\
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzyaAz9Ak2ruY/9npoZ11\n\
 S4SwZpw6Qx/4nk09xZh4nLsxEjXfXYZBzyLwLnEr040h6ZoGp4zOjAeBK+AsF2ev\n\
 6hNLktwmF7xOXA0VtlTIXX3zl96Xax4ffeEy0uoyggGI9JvH+d+Zvb07OvAbn9js\n\
 xEKVW2CUWHq9vHWUgB5mNf2B3iLj52NAjupiwyb7MfmnCCSWyjuJha428Vdsk4py\n\
 iHn3k0Z1drI3kda9x21X5EfAkdsfm++FFJ5VpB7mRpGT3qg0zX9MtID8N0ZlTYCd\n\
 7ZRlV2tPTOlOdH34tEUShESieKQBrUyxc0IT5wngxd3O6ZJ5CCLzGc4XSAeXkp8t\n\
 9QIDAQAB\n\
 -----END PUBLIC KEY-----";
 let signature64 =
 "jdTNMwoSCf5bJWeCkKve5kOdKkuLtRokcItjLHEwGRcCnmmTChk6qmopKPdiGvJL\
 w3iJfGHSh2Z71yERX35m/RVLvkbnnYQtssKFVDj49ttnDXkK/pcPLdbnWc2GPbLN\
 v5XIpgiR2FPyp2PGbwYDoYNFnOI4ICJSBfKLjjYECCGbKKj4w5QBGzXyiCL0gV6l\
 iS/7Wj1BCjwDb09FJF3oLGM5kpQlP3r1Ksh38cxsdUbBA/+29TOYclGEqw8VwgT9\
 s66tTm8sylPTu/4vTFmaHBPiLNOOE9SUl4+zU2GjpqVNtVfj66f/Lm0x1lS8qaxt\
 AY7y2KV0G5RvDkykZ7y3Yw==";
 let message = "0x59bd329d";

 // Decode base-64 signature
 let signature = Base64::decode_vec(&signature64).unwrap();

 // Convert public key PEM to a VerifyingKey.
 let public_key = rsa::RsaPublicKey::from_public_key_pem(&public_key_pem).unwrap();
 let verifying_key = VerifyingKey::<Sha256>::new(public_key);

 let verify_signature: Signature = signature.into();
 let verify_result = verifying_key.verify(message.as_bytes(), &verify_signature);
 if verify_result.is_ok() {
 println!("Verified");
 } else {
 println!("Failed");
 }
}

I've verified they both produce the same value for em internally. It seems to be the Rust rsa code in pub(crate) fn verify<PK: PublicKey> in pkcs1v15.rs that is checking the em values that is deciding it fails verification.

This might be related to issue #89.

[tarcieri]

The verification succeeds if you change:

 let verifying_key = VerifyingKey::<Sha256>::new(public_key);

to:

 let verifying_key = VerifyingKey::<Sha256>::new_with_prefix(public_key);

That sounds like the opposite of #89, namely it seems to be expecting a prefix in this case, but ::new assumes NULL, IIUC.

cc @lumag

[cmcqueen]

Thanks for the advice.

I tried it. I got errors related to trait bound AssociatedOid. I resolved that by enabling the feature oid for the sha2 crate. In Cargo.toml:

[dependencies]
sha2 = { version = "0.10.6", features = ["oid"] }
...

Now it is verifying successfully. Thank you very much for that advice.

I wonder if it would be possible to improve the documentation for the new() and new_with_prefix() functions to clarify the usage of each, for those of us not well acquainted with the finer points of the PKCS#1 v1.5 algorithm.

Alternatively, I wonder if it would be possible to simplify the API so it's not necessary to pick between new() and new_with_prefix() — as apparently the Python pycryptodome package does.

[DanHenton]

^^ Fixed my issue as well ❤️

[cmcqueen]

Should I leave this open, for possible documentation improvements of the new() and new_with_prefix() functions, or close this?

(Or I suppose leave it open for possible API simplification as I mentioned in my previous comment.)

[tarcieri]

I think it would be nice if we could make this a bit more automatic, although that could perhaps use a new issue explaining the concrete problem

This fixed my issue too, would definitely help to update the docs here.

[tarcieri]

Opened #238 to track the issues raised here.

That said, signature verification is working. Closing this.