Initial draft of signed CMS for SLH-DSA #115310

PranavSenthilnathan · 2025-05-05T18:36:29Z

CMS for SLH-DSA successfully roundtrips with openssl (message created with SignedCms can be verified with OpenSsl and vice versa). The new implementation forks Sign and Verify into a Pure and Hash mode with the Hash mode being the same as the existing implementation. All existing tests pass.

This is currently a draft mainly so some questions can be answered. These are TODOs in code and briefly enumerated here:

Countersigning
NoSignature
CheckHash
Hash strength
Are we going to support NET Framework?
Build (csproj) changes and questions about where to ifdef

dotnet-issue-labeler · 2025-05-05T18:36:36Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

dotnet-issue-labeler · 2025-05-05T18:36:37Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

dotnet-policy-service · 2025-05-05T18:37:11Z

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

vcsjones · 2025-05-05T19:46:57Z

Are we going to support NET Framework?

SignedCms and all of its associated types type-forward to the .NET Framework implementation. We can't enable it on .NET Framework through System.Security.Cryptography.Pkcs. Whatever work that needs to be done (if any) will need to be done in .NET Framework itself.

runtime/src/libraries/System.Security.Cryptography.Pkcs/ref/System.Security.Cryptography.Pkcs.netframework.cs

Line 33 in 86949c2

    
           [assembly: TypeForwardedTo(typeof(System.Security.Cryptography.Pkcs.SignedCms))]

vcsjones · 2025-05-05T20:00:45Z

I am curious if we need to implement any of this down level, since .NET Framework will have its own implementation.

I... think... it probably could make sense to implement all of the new public API surface as #if NET10_0_OR_GREATER and don't implement it down level at all.

>= net462 TFMs are going to get type-forwarded.
<= net9.0 TFMs won't have the new public API. That's okay, they should just move to .NET 10. .NET (Core) users should expect to require updating to get new capabilities.
>= netstandard2.0 this is where... maybe... there is value in doing the OOB. If someone is on netstandard and on Windows, but not .NET Framework and not .NET Core, then down level support might be justified. The one that has come up in the past is UWP.

bartonjs · 2025-05-05T21:31:17Z

...raries/System.Security.Cryptography.Pkcs/ref/System.Security.Cryptography.Pkcs.netcoreapp.cs

        public System.Security.Cryptography.AsymmetricAlgorithm? PrivateKey { get { throw null; } set { } }
        public System.Security.Cryptography.RSASignaturePadding? SignaturePadding { get { throw null; } set { } }
+        [System.Diagnostics.CodeAnalysis.ExperimentalAttribute("SYSLIB5006")]
+        public System.Security.Cryptography.SlhDsa? SlhDsaPrivateKey { get { throw null; } set { } }


Since the AsymmetricAlgorithm version has already bitten us: Don't add a public property here until we have a compelling reason.

bartonjs · 2025-05-05T21:33:27Z

...stem.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.SlhDsa.cs

+                // TODO Current spec (as of May 5, 2025) has strength requirements on the hash, but we will
+                // not enforce them here. If the callers wants to enforce them, they can do so by themselves.


So... what's the TODO? That's just a statement of fact.

bartonjs · 2025-05-05T21:36:10Z

...ries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSignature.cs

 using System.Security.Cryptography.X509Certificates;
+using Internal.Cryptography;
+using static System.Security.Cryptography.Pkcs.CmsSigner;


Suggested change

using static System.Security.Cryptography.Pkcs.CmsSigner;

bartonjs · 2025-05-05T21:38:45Z

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

+            set => _privateKey = value;
+        }
+
+        // TODO not sure why PrivateKey is ifdef'd out...


These types are typeforwarded to .NET Framework for the netfx implementation, which means the .NET Standard or .NET Framework TFMs can't expose any new members.

And that's why for .NET Framework the only scenario is "passed a certificate with an attached private key"... those ctors are the only ones that exist there.

bartonjs · 2025-05-05T21:42:14Z

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

+        CmsSigner(SubjectIdentifierType signerIdentifierType, X509Certificate2? certificate, SlhDsa? privateKey)
+            : this(signerIdentifierType, certificate, privateKey, signaturePadding: null)
+        {
+            // TODO this ctor can break users if they had been passing in null for privateKey since it's now ambiguous


Again... what's the TODO? If it's a note for API Review, that doesn't belong in code.

bartonjs · 2025-05-05T21:48:38Z

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

@@ -311,21 +405,63 @@ internal SignerInfoAsn Sign(
            ReadOnlyMemory<byte> signatureValue;
            ReadOnlyMemory<byte> signatureParameters = default;

+


Suggested change

bartonjs · 2025-05-05T22:39:07Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

+                (SlhDsaAlgorithm.SlhDsaSha2_128s, Oids.Sha256),
+                (SlhDsaAlgorithm.SlhDsaShake128f, Oids.Sha256),
+                (SlhDsaAlgorithm.SlhDsaSha2_256f, Oids.Sha512),
+                (SlhDsaAlgorithm.SlhDsaShake256f, Oids.Sha512), // TODO SHAKE256 is not supported but it's the recommended algo here..


// TODO SHAKE256 is not supported but it's the recommended algo here..

Sounds like you need to put a layer of indirection in front of IncrementalHash, then?

bartonjs · 2025-05-05T22:42:24Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

+        private delegate CmsSigner CreateSignerFunc<TKey>(SubjectIdentifierType sit, X509Certificate2 cert, TKey key);
+        private static CreateSignerFunc<AsymmetricAlgorithm> CreateAsymmetricAlgorithmSigner = (sit, cert, key) =>
+        {
+            return new CmsSigner(sit, cert, key);
+        };
+
+        private static CreateSignerFunc<SlhDsa> CreateSlhDsaSigner = (sit, cert, key) =>
+        {
+            return new CmsSigner(sit, cert, key);
+        };


I don't think these delegates add value (but do add cost and complexity).

VerifyWithExplicitPrivateKey should just take object and type test to know what to call.

And then I don't have to be upset about the chopping style used where these made the lines too long 😄

bartonjs · 2025-05-05T22:44:47Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

+            CertLoader loader = Certificates.SlhDsaGeneratedCerts.Single(cert => cert.CerData.SequenceEqual(info.Certificate));
+            using (X509Certificate2 signerCert = loader.TryGetCertificateWithPrivateKey())
+            {
+                CmsSigner signer = new CmsSigner(identifierType, signerCert);


Testing with a CmsSigner using only a cert-attached private key should also be done for the netfx tests. A fair amount of the validation here uses "new" API, so the netfx-capable test will have to be watered down.

Perhaps it should just gain #if around the parts that can't be tested in netfx, and this moved out of the netcoreapp partial.

bartonjs · 2025-05-05T22:46:24Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

@@ -868,7 +1133,13 @@ private static void VerifyWithExplicitPrivateKey(X509Certificate2 cert, Asymmetr
            }
        }

-        private static void VerifyCounterSignatureWithExplicitPrivateKey(X509Certificate2 cert, AsymmetricAlgorithm key, X509Certificate2 counterSignerCert, AsymmetricAlgorithm counterSignerKey)
+        private static void VerifyCounterSignatureWithExplicitPrivateKey<TKey, TCounterSignerKey>(


De-generic, just take object and type test.

bartonjs · 2025-05-05T22:48:53Z

...braries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs

+            byte[]? attributesToSign = null;
+            signedAttrsSet.SignedAttributes = PkcsHelpers.NormalizeAttributeSet(
+                signedAttrs.ToArray(),
+                encodedSignedAttrs => attributesToSign = encodedSignedAttrs);


If this is the only call to NormalizeAttributeSet now, just change it to out the value. Capturing via a lambda feels icky.

Looking at current usage, everyone else passes null, which means making a proper overload, one that does the work and has an out, and the other that just sends the out to discard.

refactor signed cms for pure and hashed signing

ae0e013

PranavSenthilnathan requested a review from bartonjs May 5, 2025 18:36

PranavSenthilnathan self-assigned this May 5, 2025

PranavSenthilnathan added the area-System.Security label May 5, 2025

dotnet-issue-labeler bot added the new-api-needs-documentation label May 5, 2025

bartonjs reviewed May 5, 2025

View reviewed changes

This was referenced May 5, 2025

[wasm][AOT] emcc : error - received SIGKILL (-9) #89402

Open

SIGKILL System.Runtime.Serialization.Formatters.Tests #114287

Open

bartonjs reviewed May 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial draft of signed CMS for SLH-DSA #115310

Initial draft of signed CMS for SLH-DSA #115310

PranavSenthilnathan commented May 5, 2025

dotnet-issue-labeler bot commented May 5, 2025

dotnet-issue-labeler bot commented May 5, 2025

dotnet-policy-service bot commented May 5, 2025

vcsjones commented May 5, 2025

vcsjones commented May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

bartonjs May 5, 2025

		// TODO Current spec (as of May 5, 2025) has strength requirements on the hash, but we will
		// not enforce them here. If the callers wants to enforce them, they can do so by themselves.

		@@ -311,21 +405,63 @@ internal SignerInfoAsn Sign(
		ReadOnlyMemory<byte> signatureValue;
		ReadOnlyMemory<byte> signatureParameters = default;

Initial draft of signed CMS for SLH-DSA #115310

Are you sure you want to change the base?

Initial draft of signed CMS for SLH-DSA #115310

Conversation

PranavSenthilnathan commented May 5, 2025

dotnet-issue-labeler bot commented May 5, 2025

dotnet-issue-labeler bot commented May 5, 2025

dotnet-policy-service bot commented May 5, 2025

vcsjones commented May 5, 2025

vcsjones commented May 5, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment