Verify dsa-sha1 signatures #655

const crypto = require("crypto");
const { SignedXml } = require("./lib");
const { RsaSha1 } = require("./lib/signature-algorithms");

const DSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#dsa-sha1";

// Signed by JDK 21 (javax.xml.crypto.dsig) with a 1024-bit DSA key.
const xml =
  '<root><child>data</child><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>o6nDTRHHAOWLcD3x7BcGQ1yqK8ka4y9JGBhR/zgNv0k=</DigestValue></Reference></SignedInfo><SignatureValue>k+mCmbaRlgle444fEnu+Lzah0aVZ8gCFqYfgqs5pPxkK5BZZhfpwYg==</SignatureValue></Signature></root>';
const dsaPublicKey = `-----BEGIN PUBLIC KEY-----
MIIBtzCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9E
AMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f
6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv
8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc
NrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwky
jMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/h
WuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYQAAoGARFpJZtOk/WWFi/aPGG3J/Cyi4/dw
Pwcc2aH/lAWBJDuvZ3w/4KjSKjsKB+MgzPwvG/PSOWkRKihJLOK8kqU02xvJN4gy
KxJdOQt/9MQA4B2DDM/uF5pM8laxsJ8UBgZipLu643yHcSVh8SuwQvhbTAzSY3mg
WdNYDbSB234lZ/w=
-----END PUBLIC KEY-----
`;

class DsaSha1 {
  getSignature() {
    throw new Error("dsa-sha1 is for verification only");
  }
  verifySignature(material, key, signatureValue) {
    // createPublicKey() refuses a KeyObject that is already public.
    const publicKey =
      key instanceof crypto.KeyObject && key.type === "public" ? key : crypto.createPublicKey(key);
    if (publicKey.asymmetricKeyType !== "dsa") {
      return false;
    }
    return crypto.verify(
      "sha1",
      Buffer.from(material),
      { key: publicKey, dsaEncoding: "ieee-p1363" },
      Buffer.from(signatureValue, "base64"),
    );
  }
  getAlgorithmName() {
    return DSA_SHA1;
  }
}

function check(label, document, register) {
  const sig = new SignedXml({ publicCert: dsaPublicKey });
  if (register) {
    sig.SignatureAlgorithms[DSA_SHA1] = DsaSha1;
  }
  sig.loadSignature(/<Signature[\s\S]*<\/Signature>/.exec(document)[0]);
  let result;
  try {
    result = sig.checkSignature(document);
  } catch (error) {
    result = `throws: ${error.message}`;
  }
  console.log(`${label.padEnd(52)} ${result}`);
}

check("JDK document, default algorithms", xml, false);
check("JDK document, DsaSha1 registered", xml, true);
check("JDK document edited, DsaSha1 registered", xml.replace("data", "date"), true);

// The digest name does not bind the key type: Node takes the algorithm from the key.
const material = Buffer.from("<SignedInfo/>");
const dsa = crypto.generateKeyPairSync("dsa", { modulusLength: 1024, divisorLength: 160 });
const rsa = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
const dsaDer = crypto.sign("sha1", material, dsa.privateKey).toString("base64");
const rsaSig = crypto.sign("sha1", material, rsa.privateKey);
const row = (label, result) => console.log(`${label.padEnd(52)} ${result}`);
row(
  "RsaSha1 given a DSA key and a DER DSA signature",
  new RsaSha1().verifySignature(material.toString(), dsa.publicKey, dsaDer),
);
row(
  "DsaSha1 given an RSA key and an RSA-SHA1 signature",
  new DsaSha1().verifySignature(material.toString(), rsa.publicKey, rsaSig.toString("base64")),
);
row(
  "the same without the key-type check",
  crypto.verify("sha1", material, { key: rsa.publicKey, dsaEncoding: "ieee-p1363" }, rsaSig),
);