gpgsm unable to extract signers from a valid (?) signature

[Werner Koch]

Hi!

Yeah an old mail from your but let me explain the problem:

On Tue,  1 Oct 2024 17:40, Albrecht Dreß said:

> I stumbled over a S/MIME signed message where gpgsm seems to be unable
> to extract the signers and to verify the signature.  Using the
> attached signature blob and a dummy “message” part, gpgsm says just
>
> <snip>
> $ gpgsm --debug-level basic --verify SIG.bin dummy.txt
> gpgsm: enabled debug flags: ipc
> gpgsm: enabled compatibility flags:
> gpgsm: detached signature
> secmem usage: 0/16384 bytes in 0 blocks
> </snip>

This signature is a certificate-only message:

$ ~/b/libksba/tests/t-cms-parser SIG.bin 
*** checking `SIG.bin' ***
identified as: signed data
stop reason: 2
ContentType: 1.2.840.113549.1.7.2
stop reason: 3
EncapsulatedContentType: 1.2.840.113549.1.7.1
DigestAlgorithms: 2.16.840.1.101.3.4.2.1
Detached signature
stop reason: 6
this is a certs-only message
*** all checks done

This is a dump of your signature

   0 1294: SEQUENCE {
   4    9:   OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
  15 1279:   [0] {
  19 1275:     SEQUENCE {
  23    1:       INTEGER 1
  26   15:       SET {
  28   13:         SEQUENCE {
  30    9:           OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
  41    0:           NULL
         :           }
         :         }
  43   11:       SEQUENCE {
  45    9:         OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
         :         }
  56  869:       [0] {
  60  865:         SEQUENCE {
  64  457:           SEQUENCE {
  68    3:             [0] {
  70    1:               INTEGER 2
         :               }
  [...]

And here is a proper detached signature:

   0 NDEF: SEQUENCE {
   2    9:   OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
  17    1:       INTEGER 1
  20   13:       SET {
  22   11:         SEQUENCE {
  24    9:           OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
         :           }
         :         }
  35   11:       SEQUENCE {
  37    9:         OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
         :         }
  48 8613:       [0] {
  52 1965:         SEQUENCE {
  56 1429:           SEQUENCE {
  60    3:             [0] {
  62    1:               INTEGER 2
         :               }
  [...]

Your signature is missing the part of the signature which is in the
proper signature from offset 17..47.  Instead it starts off directly
with the list of certificates indicated by a context tag 0 at offset 15
which starts in the proper signature at offset 35

What we should do is to print a message that this is a cert-only
signature in the same way the LibKSBA test tool does it.


Shalom-Salam,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openpgp-digital-signature.asc
Type: application/pgp-signature
Size: 247 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20250506/6b7f7657/attachment.sig>