GithubStar/UA-.NETStandard
1
0
Fork 0
mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-26 04:19:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

SHA-1 signatures will no longer be trusted by default (#2406)

Browse Source 
Since some distributions stop to trust SHA1 signatures by default, replace some internal algorithm checks with SHA256 versions.
The test case to force signature check also reenables ECC tests for .NET 4.8 which had been previously disabled.
This commit is contained in:
Martin Regen
2023-12-01 09:36:45 +01:00
committed by GitHub
parent 724954fe91
commit 8a2cf92710
5 changed files with 33 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Libraries/Opc.Ua.Security.Certificates/X509Certificate/X509PfxUtils.cs
+2 -2
View File
@@ -193,8 +193,8 @@ namespace Opc.Ua.Security.Certificates
byte[] testBlock = new byte[TestBlockSize];
var rnd = new Random();
rnd.NextBytes(testBlock);
byte[] signature = rsaPrivateKey.SignData(testBlock, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
return rsaPublicKey.VerifyData(testBlock, signature, HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);
byte[] signature = rsaPrivateKey.SignData(testBlock, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
return rsaPublicKey.VerifyData(testBlock, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
}
#if ECC_SUPPORT
Stack/Opc.Ua.Core/Security/Certificates/RsaUtils.cs
+2 -2
View File
@@ -330,8 +330,8 @@ namespace Opc.Ua
int blockSize = 0x10;
byte[] testBlock = new byte[blockSize];
randomSource.NextBytes(testBlock, 0, blockSize);
byte[] signature = privateKey.SignData(testBlock, HashAlgorithmName.SHA1, RSASignaturePadding.Pss);
return publicKey.VerifyData(testBlock, signature, HashAlgorithmName.SHA1, RSASignaturePadding.Pss);
byte[] signature = privateKey.SignData(testBlock, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);
return publicKey.VerifyData(testBlock, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);
}
catch
{
Tests/Opc.Ua.Security.Certificates.Tests/CertificateTestsForECDsa.cs
+2
View File
@@ -378,8 +378,10 @@ namespace Opc.Ua.Security.Certificates.Tests
PEMWriter.ExportCertificateAsPEM(certificate);
if (certificate.HasPrivateKey)
{
#if !NETFRAMEWORK
PEMWriter.ExportPrivateKeyAsPEM(certificate, password);
PEMWriter.ExportECDsaPrivateKeyAsPEM(certificate);
#endif
}
}
#endregion
Tests/Opc.Ua.Security.Certificates.Tests/CertificateTestsForRSA.cs
+17 -8
View File
@@ -84,9 +84,9 @@ namespace Opc.Ua.Security.Certificates.Tests
public void VerifyOneSelfSignedAppCertForAll()
{
var builder = CertificateBuilder.Create(Subject)
.SetNotBefore(DateTime.Today.AddYears(-1))
.SetNotAfter(DateTime.Today.AddYears(25))
.AddExtension(new X509SubjectAltNameExtension("urn:opcfoundation.org:mypc", new string[] { "mypc", "mypc.opcfoundation.org", "192.168.1.100" }));
.SetNotBefore(DateTime.Today.AddYears(-1))
.SetNotAfter(DateTime.Today.AddYears(25))
.AddExtension(new X509SubjectAltNameExtension("urn:opcfoundation.org:mypc", new string[] { "mypc", "mypc.opcfoundation.org", "192.168.1.100" }));
byte[] previousSerialNumber = null;
foreach (var keyHash in KeyHashPairs)
{
@@ -143,21 +143,30 @@ namespace Opc.Ua.Security.Certificates.Tests
[Theory]
public void CreateSelfSignedForRSADefaultHashCustomKey(
KeyHashPair keyHashPair
KeyHashPair keyHashPair,
bool signOnly
)
{
// default cert with custom key
X509Certificate2 cert = CertificateBuilder.Create(Subject)
.SetRSAKeySize(keyHashPair.KeySize)
.CreateForRSA();
var builder = CertificateBuilder.Create(Subject);
if (signOnly)
{
// Key usage for sign only
X509KeyUsageFlags keyUsageFlags = X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.NonRepudiation;
builder.AddExtension(new X509KeyUsageExtension(keyUsageFlags, true));
}
X509Certificate2 cert = builder.SetRSAKeySize(keyHashPair.KeySize).CreateForRSA();
WriteCertificate(cert, $"Default RSA {keyHashPair.KeySize} cert");
X509Utils.VerifyRSAKeyPair(cert, cert, true);
Assert.AreEqual(Subject, cert.Subject);
Assert.AreEqual(keyHashPair.KeySize, cert.GetRSAPublicKey().KeySize);
Assert.AreEqual(X509Defaults.HashAlgorithmName, Oids.GetHashAlgorithmName(cert.SignatureAlgorithm.Value));
TestUtils.ValidateSelSignedBasicConstraints(cert);
Assert.AreEqual(cert.SubjectName.Name, cert.IssuerName.Name);
Assert.AreEqual(cert.SubjectName.RawData, cert.IssuerName.RawData);
X509Utils.VerifyRSAKeyPair(cert, cert, true);
Assert.True(X509Utils.VerifySelfSigned(cert));
}
Tests/Opc.Ua.Security.Certificates.Tests/Opc.Ua.Security.Certificates.Tests.csproj
+10 -2
View File
@@ -1,4 +1,4 @@
<Project Sdk="Microsoft.NET.Sdk">
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
@@ -15,6 +15,10 @@
<DefineConstants>$(DefineConstants);ECC_SUPPORT</DefineConstants>
</PropertyGroup>
<PropertyGroup Condition="'$(TargetFramework)' == 'net48'">
<DefineConstants>$(DefineConstants);ECC_SUPPORT</DefineConstants>
</PropertyGroup>
<PropertyGroup Condition="'$(TargetFramework)' == 'net5.0'">
<DefineConstants>$(DefineConstants);ECC_SUPPORT</DefineConstants>
</PropertyGroup>
@@ -22,7 +26,11 @@
<PropertyGroup Condition="'$(TargetFramework)' == 'net6.0'">
<DefineConstants>$(DefineConstants);ECC_SUPPORT</DefineConstants>
</PropertyGroup>
<PropertyGroup Condition="'$(TargetFramework)' == 'net8.0'">
<DefineConstants>$(DefineConstants);ECC_SUPPORT</DefineConstants>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
<PackageReference Include="NUnit" Version="3.14.0" />