@@ -379,19 +379,11 @@ def sign(self, data, key=None, passphrase=None, cert=None, reference_uri=None, k
379
379
signature = key .sign (signed_info_c14n , padding = PKCS1v15 (), algorithm = hash_alg )
380
380
else :
381
381
raise NotImplementedError ()
382
- if self .sign_alg .startswith ("dsa-" ):
383
- # Note: The output of the DSA signer is a DER-encoded ASN.1 sequence of two DER integers.
384
- from asn1crypto .algos import DSASignature
385
- decoded_signature = DSASignature .load (signature ).native
386
- r = decoded_signature ['r' ]
387
- s = decoded_signature ['s' ]
388
- signature = long_to_bytes (r ).rjust (32 , b"\0 " ) + long_to_bytes (s ).rjust (32 , b"\0 " )
389
- elif self .sign_alg .startswith ("ecdsa-" ):
390
- # Note: The output of the ECDSA signer is a DER-encoded ASN.1 sequence of two DER integers.
382
+ if self .sign_alg .startswith ("dsa-" ) or self .sign_alg .startswith ("ecdsa-" ):
383
+ # Note: The output of the DSA and ECDSA signers is a DER-encoded ASN.1 sequence of two DER integers.
391
384
(r , s ) = utils .decode_dss_signature (signature )
392
385
int_len = key .key_size // 8
393
- signature = long_to_bytes (r , blocksize = int_len )
394
- signature += long_to_bytes (s , blocksize = int_len )
386
+ signature = long_to_bytes (r , blocksize = int_len ) + long_to_bytes (s , blocksize = int_len )
395
387
396
388
signature_value_element .text = ensure_str (b64encode (signature ))
397
389
@@ -575,9 +567,9 @@ def _verify_signature_with_pubkey(self, signed_info_c14n, raw_signature, key_val
575
567
y = self ._get_long (dsa_key_value , "Y" )
576
568
pn = dsa .DSAPublicNumbers (y = y , parameter_numbers = dsa .DSAParameterNumbers (p = p , q = q , g = g ))
577
569
key = pn .public_key (backend = default_backend ())
578
- from asn1crypto . algos import DSASignature
579
- sig_as_der_seq = DSASignature . from_p1363 (raw_signature ). dump ( )
580
- key .verify (sig_as_der_seq ,
570
+ # TODO: supply meaningful key_size_bits for signature length assertion
571
+ dss_signature = self . _encode_dss_signature (raw_signature , len ( raw_signature ) * 8 / 2 )
572
+ key .verify (dss_signature ,
581
573
data = signed_info_c14n ,
582
574
algorithm = self ._get_signature_digest_method (signature_alg ))
583
575
elif "rsa-" in signature_alg :
0 commit comments