From d3b10844efeca4113d9a9b625aff1659b661f30e Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 31 Mar 2026 11:47:02 +0100 Subject: [PATCH 01/16] Add additional test for empty digest error bug Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 3e3f7f1d7d..2d741ec56e 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -1,3 +1,7 @@ +PKCS7 PKCS11 With Empty Digest +depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA + PKCS7 Signed Data Parse Pass SHA256 #1 depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA From e23a57ad43f82d861aecc37e5a3bb3a35a5f0e31 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 13:55:30 +0100 Subject: [PATCH 02/16] Add fix for empty digestAlgorithm Signed-off-by: Ben Taylor --- library/pkcs7.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/library/pkcs7.c b/library/pkcs7.c index 2cc7812bf0..61e9ee9754 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -142,6 +142,10 @@ static int pkcs7_get_digest_algorithm_set(unsigned char **p, return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_ALG, ret); } + if (len == 0) { + return 0; + } + end = *p + len; ret = mbedtls_asn1_get_alg_null(p, end, alg); @@ -481,9 +485,11 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen, return ret; } - ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg); - if (ret != 0) { - return MBEDTLS_ERR_PKCS7_INVALID_ALG; + if (signed_data->digest_alg_identifiers.p != NULL) { + ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg); + if (ret != 0) { + return MBEDTLS_ERR_PKCS7_INVALID_ALG; + } } mbedtls_pkcs7_buf content_type; From dd015dc85b4ad14a0044fe8daf035beec81c27c4 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 14:46:34 +0100 Subject: [PATCH 03/16] Add test for unsupported algorithm Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 2d741ec56e..8fdff435c0 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -2,6 +2,9 @@ PKCS7 PKCS11 With Empty Digest depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA +PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet +pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA + PKCS7 Signed Data Parse Pass SHA256 #1 depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA From fb3f1758b0919d563fa47191adeb2d56f440cc9d Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 15:22:29 +0100 Subject: [PATCH 04/16] Add test to verify how mbedtls_pkcs7_signed_data_verify and mbedtls_pkcs7_signed_hash_verify deals with a empty digest algorithm Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 8fdff435c0..ad09a489bf 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -89,6 +89,10 @@ PKCS7 Signed Data Verification Pass SHA256 #9 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 +PKCS7 Signed Data Parse Fail SHA256 empty digestAlgorithms +depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO + PKCS7 Signed Data Verification Pass SHA256 #9.1 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0 From 23338f83809aec83e059e6f486f2d7345b7911c3 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 15:38:24 +0100 Subject: [PATCH 05/16] Add ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/empty-digest-failure.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/empty-digest-failure.txt diff --git a/ChangeLog.d/empty-digest-failure.txt b/ChangeLog.d/empty-digest-failure.txt new file mode 100644 index 0000000000..9ec0dc40ed --- /dev/null +++ b/ChangeLog.d/empty-digest-failure.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix PKCS7 parsing so that it is able to deal with and empty + digestAlgorithm. From 7e2e9e7b0d8627cfe2512e97a7b7d9d3950583a9 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 5 May 2026 08:04:58 +0100 Subject: [PATCH 06/16] Fix code style Signed-off-by: Ben Taylor --- library/pkcs7.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/pkcs7.c b/library/pkcs7.c index 61e9ee9754..1755b8449f 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -488,7 +488,7 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen, if (signed_data->digest_alg_identifiers.p != NULL) { ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg); if (ret != 0) { - return MBEDTLS_ERR_PKCS7_INVALID_ALG; + return MBEDTLS_ERR_PKCS7_INVALID_ALG; } } From 1fffed8d56ae72a99d8efc558541fd640bf41cd4 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 6 May 2026 15:21:37 +0100 Subject: [PATCH 07/16] Added additional guard for PSA_WANT_ALG_SHA_256 Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index ad09a489bf..b4cfda7c26 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -3,6 +3,7 @@ depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet +depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA PKCS7 Signed Data Parse Pass SHA256 #1 From 832dfebb4ebef4dfa5622d7878ece93d423fb6c4 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 30 Jun 2026 15:11:24 +0100 Subject: [PATCH 08/16] Add test for unsupported DigestAlgorithmSet passed to mbedtls_pkcs7_parse_der Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index b4cfda7c26..901d3dbeaf 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -2,6 +2,10 @@ PKCS7 PKCS11 With Empty Digest depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA +PKCS7 PKCS11 With Unsupported DigestAlgorithmnSet +depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA + PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA From 0e322242d8913795c25a1cd1e2499bd2b693a33d Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Tue, 30 Jun 2026 15:28:55 +0100 Subject: [PATCH 09/16] Add two more tests for mbedtls_pkcs7_signed_data_verify() and mbedtls_pkcs7_signed_hash_verify() Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 901d3dbeaf..8475bfee9c 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -94,6 +94,10 @@ PKCS7 Signed Data Verification Pass SHA256 #9 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 +PKCS7 Signed Data Verification Fail empty digestAlgorithms +depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID + PKCS7 Signed Data Parse Fail SHA256 empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO @@ -102,6 +106,10 @@ PKCS7 Signed Data Verification Pass SHA256 #9.1 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0 +PKCS7 Signed Hash Verification Fail empty digestAlgorithms +depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID + PKCS7 Signed Data Verification Pass SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 From b7a62b453668cec8603dd73247c83917d5fb0769 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 1 Jul 2026 11:50:26 +0100 Subject: [PATCH 10/16] Add modification to pkcs7_get_signer_info to continue with empty digestAlgorithms, leaving the failure to be dtected by the verify Signed-off-by: Ben Taylor --- library/pkcs7.c | 13 +++++++++---- tests/suites/test_suite_pkcs7.data | 8 ++++---- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/library/pkcs7.c b/library/pkcs7.c index 1755b8449f..d008518f3d 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -337,10 +337,15 @@ static int pkcs7_get_signer_info(unsigned char **p, unsigned char *end, goto out; } - /* Check that the digest algorithm used matches the one provided earlier */ - if (signer->alg_identifier.tag != alg->tag || - signer->alg_identifier.len != alg->len || - memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0) { + /* + * If digestAlgorithms is present, require the signer digest algorithm to + * match it. If the outer set is empty, defer the failure until + * verification, where the missing digest algorithm is reported. + */ + if (alg->p != NULL && + (signer->alg_identifier.tag != alg->tag || + signer->alg_identifier.len != alg->len || + memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0)) { ret = MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO; goto out; } diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 8475bfee9c..7773233df7 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -96,11 +96,11 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../fra PKCS7 Signed Data Verification Fail empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID -PKCS7 Signed Data Parse Fail SHA256 empty digestAlgorithms +PKCS7 Signed Data Parse Pass SHA256 empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY -pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO +pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA PKCS7 Signed Data Verification Pass SHA256 #9.1 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY @@ -108,7 +108,7 @@ pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../fra PKCS7 Signed Hash Verification Fail empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID PKCS7 Signed Data Verification Pass SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY From b3d68d088d23101d618b1c2cb13c6fdfdeb1b3ab Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 6 Jul 2026 15:16:32 +0100 Subject: [PATCH 11/16] Amend description of tests to remove reference to PKCS11 and remove dependencies Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 7773233df7..d2e54471d3 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -1,8 +1,7 @@ -PKCS7 PKCS11 With Empty Digest -depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +PKCS7 With Empty Digest pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA -PKCS7 PKCS11 With Unsupported DigestAlgorithmnSet +PKCS7 With Unsupported DigestAlgorithmnSet depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA From 15d4fd7b7602bfb17f67d0f41353faf6af39807c Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 6 Jul 2026 15:21:44 +0100 Subject: [PATCH 12/16] Remove duplicate test Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 4 ---- 1 file changed, 4 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index d2e54471d3..8a3ecd6f97 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -1,10 +1,6 @@ PKCS7 With Empty Digest pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA -PKCS7 With Unsupported DigestAlgorithmnSet -depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY -pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA - PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA From dadca0ab87b1eeb424fbace0d48cfe6250317fcb Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 6 Jul 2026 15:23:21 +0100 Subject: [PATCH 13/16] Update the PSA_WANT_ALG_SHA_256 to PSA_WANT_ALG_SHA_256 in the uinsupported algorithm test Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 8a3ecd6f97..9f6570c1f3 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -2,7 +2,7 @@ PKCS7 With Empty Digest pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet -depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA PKCS7 Signed Data Parse Pass SHA256 #1 From 5114edbf2a35ad5fd1ff6a50e6d4ca9fbd8dd56d Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 6 Jul 2026 15:24:42 +0100 Subject: [PATCH 14/16] Relocate PKCS7 Signed Hash Verification Fail empty digestAlgorithms to a more logical location Signed-off-by: Ben Taylor --- tests/suites/test_suite_pkcs7.data | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data index 9f6570c1f3..470a8d710b 100644 --- a/tests/suites/test_suite_pkcs7.data +++ b/tests/suites/test_suite_pkcs7.data @@ -93,6 +93,10 @@ PKCS7 Signed Data Verification Fail empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID +PKCS7 Signed Hash Verification Fail empty digestAlgorithms +depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY +pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID + PKCS7 Signed Data Parse Pass SHA256 empty digestAlgorithms depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA @@ -101,10 +105,6 @@ PKCS7 Signed Data Verification Pass SHA256 #9.1 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0 -PKCS7 Signed Hash Verification Fail empty digestAlgorithms -depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY -pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID - PKCS7 Signed Data Verification Pass SHA1 #10 depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0 From 8edc147cae8f9b5316167f4d4ab27917d8ec2cf3 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 8 Jul 2026 10:02:47 +0100 Subject: [PATCH 15/16] Add additional clarification to the empty digest changelog Signed-off-by: Ben Taylor --- ChangeLog.d/empty-digest-failure.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/empty-digest-failure.txt b/ChangeLog.d/empty-digest-failure.txt index 9ec0dc40ed..04e1738a58 100644 --- a/ChangeLog.d/empty-digest-failure.txt +++ b/ChangeLog.d/empty-digest-failure.txt @@ -1,3 +1,4 @@ Bugfix * Fix PKCS7 parsing so that it is able to deal with and empty - digestAlgorithm. + digestAlgorithm. The system will now alwys pass the digest algorithm, + though if it is not support is will fail later in verification. From 7d204ac0ef68bd069b1845d421afdee98d72bcab Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Wed, 8 Jul 2026 10:33:18 +0100 Subject: [PATCH 16/16] Update ChangeLog.d/empty-digest-failure.txt Co-authored-by: Valerio Setti <92275829+valeriosetti@users.noreply.github.com> Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/empty-digest-failure.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/empty-digest-failure.txt b/ChangeLog.d/empty-digest-failure.txt index 04e1738a58..2cec3a844a 100644 --- a/ChangeLog.d/empty-digest-failure.txt +++ b/ChangeLog.d/empty-digest-failure.txt @@ -1,4 +1,4 @@ Bugfix - * Fix PKCS7 parsing so that it is able to deal with and empty - digestAlgorithm. The system will now alwys pass the digest algorithm, - though if it is not support is will fail later in verification. + * Fix PKCS7 so that it successfully parses also in case of empty + or not supported digest algorithms. Validation of the digest algorithm + is performed at validation step.