Skip to contentSkip to conversation

pkcs7: Check all signers before waiving authattrs rejection

PATCH In review Jérémy Jean 2 participants 2 messages Aug 22 – Sep 23

Subsystems (3)
Crypto API Keys/keyrings Asymmetric keys
lore
Share & tools
lore

Jérémy Jean

author
#0 lore raw

PATCH 1/1 pkcs7: Check all signers before waiving authattrs rejection

pkcs7_check_authattrs() only looks at the first SignerInfo when deciding whether rejection of authenticated attributes may be waived. For the remaining signers it checks only that authenticated attributes are either present on all signers or absent from all of them.

This means an unmatched ML-DSA signer can be placed first, followed by a trusted RSA, ECDSA, or ECRDSA signer. Verification skips the unmatched signature and accepts the later trusted signer. The first signer still leaves the waiver enabled for the whole message, so the non-ML-DSA signer can use an exception intended only for ML-DSA.

Check each SignerInfo's public-key algorithm before leaving the waiver enabled.

Fixes 91db696adea4 ("pkcs7: Allow authenticatedAttributes for ML-DSA")
Assisted-by Codex:gpt-5
Signed-off-by Jérémy Jean <[email protected]>
---
 crypto/asymmetric_keys/pkcs7_parser.c | 6 ++++++
 1 file changed, 6 insertions(+)
crypto/asymmetric_keys/pkcs7_parser.c +6 -0
index 6e3ffda..7f00e45 100644
@@ -111,6 +111,12 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
 		if (!!sinfo->authattrs != want)
 			goto inconsistent;
 
+#ifdef CONFIG_PKCS7_WAIVE_AUTHATTRS_REJECTION_FOR_MLDSA
+		if (sinfo->authattrs &&
+		    strncmp(sinfo->sig->pkey_algo, "mldsa", 5) != 0)
+			msg->authattrs_rej_waivable = false;
+#endif
+
 		if (!sinfo->authattrs &&
 		    sinfo->sig->algo_takes_data)
 			sinfo->sig->hash_algo = "none";
Signature · 1 line
2.47.3
maintainer
#1 lore raw
Quoted 14 lines · Jérémy Jean

pkcs7_check_authattrs() only looks at the first SignerInfo when deciding whether rejection of authenticated attributes may be waived. For the remaining signers it checks only that authenticated attributes are either present on all signers or absent from all of them.

This means an unmatched ML-DSA signer can be placed first, followed by a trusted RSA, ECDSA, or ECRDSA signer. Verification skips the unmatched signature and accepts the later trusted signer. The first signer still leaves the waiver enabled for the whole message, so the non-ML-DSA signer can use an exception intended only for ML-DSA.

Check each SignerInfo's public-key algorithm before leaving the waiver enabled.

Quoted 6 lines
Fixes 91db696adea4 ("pkcs7: Allow authenticatedAttributes for ML-DSA")
Assisted-by Codex:gpt-5
Signed-off-by Jérémy Jean <[email protected]>
---
 crypto/asymmetric_keys/pkcs7_parser.c | 6 ++++++
 1 file changed, 6 insertions(+)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt