feat(签名验签): 优化签名验签

ofdgo_sign_gbt.go

@@ -111,6 +111,9 @@ func verifyRawPublicKeySignature(method, digestMethod string, signedValue, signe
 	if len(options.SignCerts) == 0 {
 		return nil, fmt.Errorf("signature certificate not found")
 	}
+	if _, err := signatureMethodHash(method, digestMethod); err != nil {
+		return nil, err
+	}
 	result := &digitalVerifyResult{DataHashOK: true}
 	for _, cert := range options.SignCerts {
 		ok, err := verifyPublicKeySignature(method, digestMethod, cert, signedData, signedValue)
@@ -169,6 +172,7 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature
 		}
 		cert := sd.findCert(signer.Issuer, signer.Serial)
 		if cert == nil {
+			result.CertOK = false
 			return result, nil
 		}
 		result.Cert = cert.Raw
@@ -177,10 +181,11 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature
 		if isSM2SignatureMethod(signer.SignatureAlg) {
 			pub, err := parseSM2PublicKeyFromCert(cert.Raw)
 			if err != nil {
+				result.CertOK = false
 				return result, err
 			}
-			result.CertOK = true
 			if !sm2VerifySignature(pub, nil, plain, signer.Signature) {
+				result.CertOK = true
 				return result, nil
 			}
 			continue
@@ -190,13 +195,15 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature
 		}
 		ok, err := verifyPublicKeySignature(signer.SignatureAlg, signer.DigestAlg, cert.Raw, plain, signer.Signature)
 		if err != nil {
+			result.CertOK = false
 			return result, err
 		}
-		result.CertOK = true
 		if !ok {
+			result.CertOK = true
 			return result, nil
 		}
 	}
+	result.CertOK = true
 	result.SignedOK = true
 	return result, nil
 }
@@ -328,34 +335,14 @@ func parseGBTCertificates(raw asn1.RawValue) ([]gbtCertificate, error) {
 // 入参: data DER编码证书
 // 返回: gbtCertificate 证书索引信息, error 错误信息
 func parseGBTCertificate(data []byte) (gbtCertificate, error) {
-	var cert struct {
-		TBSCertificate     asn1.RawValue
-		SignatureAlgorithm asn1.RawValue
-		SignatureValue     asn1.BitString
-	}
-	rest, err := asn1.Unmarshal(data, &cert)
-	if err != nil || len(rest) != 0 {
-		return gbtCertificate{}, fmt.Errorf("invalid certificate")
-	}
-	items, ok := asn1Children(cert.TBSCertificate.Bytes)
-	if !ok {
-		return gbtCertificate{}, fmt.Errorf("invalid tbs certificate")
-	}
-	idx := 0
-	if len(items) > 0 && items[0].Class == asn1.ClassContextSpecific && items[0].Tag == 0 {
-		idx++
-	}
-	if len(items) <= idx+2 {
-		return gbtCertificate{}, fmt.Errorf("invalid certificate issuer")
-	}
-	serial, err := asn1IntegerBig(items[idx])
+	cert, err := parseSignatureCertificate(data)
 	if err != nil {
 		return gbtCertificate{}, err
 	}
 	return gbtCertificate{
-		Raw:    append([]byte(nil), data...),
-		Issuer: append([]byte(nil), items[idx+2].FullBytes...),
-		Serial: serial,
+		Raw:    cert.Raw,
+		Issuer: cert.Issuer,
+		Serial: cert.Serial,
 	}, nil
 }
 

ofdgo_sign_ses.go

@@ -425,30 +425,11 @@ func parseSESPicture(raw asn1.RawValue) (string, []byte, error) {
 // 入参: data DER编码证书
 // 返回: sm2PublicKey SM2公钥, error 错误信息
 func parseSM2PublicKeyFromCert(data []byte) (sm2PublicKey, error) {
-	var cert struct {
-		TBSCertificate     asn1.RawValue
-		SignatureAlgorithm asn1.RawValue
-		SignatureValue     asn1.BitString
-	}
-	rest, err := asn1.Unmarshal(data, &cert)
+	cert, err := parseSignatureCertificate(data)
 	if err != nil {
 		return sm2PublicKey{}, err
 	}
-	if len(rest) != 0 {
-		return sm2PublicKey{}, fmt.Errorf("invalid certificate")
-	}
-	items, ok := asn1Children(cert.TBSCertificate.Bytes)
-	if !ok {
-		return sm2PublicKey{}, fmt.Errorf("invalid tbs certificate")
-	}
-	idx := 0
-	if len(items) > 0 && items[0].Class == asn1.ClassContextSpecific && items[0].Tag == 0 {
-		idx++
-	}
-	if len(items) <= idx+5 {
-		return sm2PublicKey{}, fmt.Errorf("invalid public key info")
-	}
-	return parseSM2PublicKeyInfo(items[idx+5])
+	return parseSM2PublicKeyInfo(cert.PublicKey)
 }
 
 // parseSM2PublicKeyInfo 解析SM2公钥信息

ofdgo_sign_verify.go

@@ -103,7 +103,7 @@ type SignatureVerifyOption func(*signatureVerifyOptions)
 // 返回: SignatureVerifyOption 签名验证选项
 func WithSignatureCert(cert []byte) SignatureVerifyOption {
 	return func(o *signatureVerifyOptions) {
-		o.SignCerts = append(o.SignCerts, parseSignatureCerts(cert)...)
+		o.SignCerts = appendSignatureCerts(o.SignCerts, cert)
 	}
 }
 
@@ -112,9 +112,7 @@ func WithSignatureCert(cert []byte) SignatureVerifyOption {
 // 返回: SignatureVerifyOption 签名验证选项
 func WithSignatureCerts(certs ...[]byte) SignatureVerifyOption {
 	return func(o *signatureVerifyOptions) {
-		for _, cert := range certs {
-			o.SignCerts = append(o.SignCerts, parseSignatureCerts(cert)...)
-		}
+		o.SignCerts = appendSignatureCerts(o.SignCerts, certs...)
 	}
 }
 
@@ -123,7 +121,7 @@ func WithSignatureCerts(certs ...[]byte) SignatureVerifyOption {
 // 返回: SignatureVerifyOption 签名验证选项
 func WithSignatureTrustCert(cert []byte) SignatureVerifyOption {
 	return func(o *signatureVerifyOptions) {
-		o.TrustCerts = append(o.TrustCerts, parseSignatureCerts(cert)...)
+		o.TrustCerts = appendSignatureCerts(o.TrustCerts, cert)
 	}
 }
 
@@ -132,9 +130,7 @@ func WithSignatureTrustCert(cert []byte) SignatureVerifyOption {
 // 返回: SignatureVerifyOption 签名验证选项
 func WithSignatureTrustCerts(certs ...[]byte) SignatureVerifyOption {
 	return func(o *signatureVerifyOptions) {
-		for _, cert := range certs {
-			o.TrustCerts = append(o.TrustCerts, parseSignatureCerts(cert)...)
-		}
+		o.TrustCerts = appendSignatureCerts(o.TrustCerts, certs...)
 	}
 }
 
@@ -147,6 +143,16 @@ func WithSignatureVerifyTime(t time.Time) SignatureVerifyOption {
 	}
 }
 
+// appendSignatureCerts 追加签名证书
+// 入参: dst 目标证书列表, certs DER或PEM编码证书列表
+// 返回: [][]byte 证书列表
+func appendSignatureCerts(dst [][]byte, certs ...[]byte) [][]byte {
+	for _, cert := range certs {
+		dst = append(dst, parseSignatureCerts(cert)...)
+	}
+	return dst
+}
+
 // VerifySignaturesBytes 验证OFD字节数据签名
 // 入参: data OFD字节数据, opts 签名验证选项
 // 返回: []SignatureVerifyReport 签名验证报告, error 错误信息
@@ -597,8 +603,12 @@ func (report *SignatureVerifyReport) applySignatureCertificatePolicy(options *si
 	if len(options.TrustCerts) != 0 {
 		report.CertTrustChecked = true
 		report.CertTrustOK = true
+		pool := append([][]byte{}, options.SignCerts...)
+		pool = append(pool, extraCerts...)
+		pool = append(pool, options.TrustCerts...)
+		pool = compactSignatureCerts(pool)
 		for _, cert := range certs {
-			if !signatureCertTrusted(cert, options, extraCerts) {
+			if !signatureCertTrustedBy(cert, pool, options.TrustCerts, make(map[string]bool)) {
 				report.CertTrustOK = false
 				break
 			}
@@ -637,14 +647,6 @@ func signatureCertsValidAt(certs [][]byte, t time.Time) bool {
 	return true
 }
 
-// signatureCertTrusted 判断证书是否受信任
-// 入参: cert 证书, options 验证选项, extraCerts 额外证书池
-// 返回: bool 是否受信任
-func signatureCertTrusted(cert []byte, options *signatureVerifyOptions, extraCerts [][]byte) bool {
-	pool := compactSignatureCerts(append(append(append([][]byte{}, options.SignCerts...), extraCerts...), options.TrustCerts...))
-	return signatureCertTrustedBy(cert, pool, options.TrustCerts, make(map[string]bool))
-}
-
 // signatureCertTrustedBy 判断证书是否可链到信任证书
 // 入参: cert 证书, pool 证书池, trusts 信任证书, visited 已访问证书
 // 返回: bool 是否受信任
@@ -790,6 +792,7 @@ type signatureCertificate struct {
 	IssuerValue  asn1.RawValue
 	Subject      []byte
 	SubjectValue asn1.RawValue
+	PublicKey    asn1.RawValue
 	Serial       *big.Int
 	NotBefore    time.Time
 	NotAfter     time.Time
@@ -843,6 +846,7 @@ func parseSignatureCertificate(data []byte) (signatureCertificate, error) {
 		IssuerValue:  items[idx+2],
 		Subject:      append([]byte(nil), items[idx+4].FullBytes...),
 		SubjectValue: items[idx+4],
+		PublicKey:    items[idx+5],
 		Serial:       serial,
 		NotBefore:    validity[0],
 		NotAfter:     validity[1],