[ADD] issuer info #1

ovnicraft · 2019-12-15T20:45:25Z

TODO:

has a bug with public_bytes() in next lines fixed with fefd820
b64 for digest

TODO: has a bug with public_bytes() in next lines

ghost · 2019-12-15T20:45:30Z

There were the following issues with this Pull Request

Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

ghost · 2019-12-15T21:51:38Z

There were the following issues with this Pull Request

Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty
Commit: fefd820
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

ghost · 2019-12-16T01:00:04Z

There were the following issues with this Pull Request

Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty
Commit: fefd820
- ✖ message may not be empty
- ✖ type may not be empty
Commit: f6db4d4
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

blaggacao

Some quick comments, I hope to be able to do a full review in the coming days. Honestly it might take well into the christmas holiday, though, I've to double check with @Deiber as well.

blaggacao · 2019-12-16T01:16:55Z

signxml/xades/__init__.py

                serial_element = XADES132.IssuerSerialV2(
-                    # TODO implement, wtf?
+                    DS.X09IssuerName(issuer_string(cert)),
+                    DS.X509SerialNumber(f"cert.get_serial_number()")


Not quite yet: <xsd:element name="IssuerSerialV2" type="xsd:base64Binary" minOccurs="0"/>
The whole ASN.1 object shall be DER encoded and put here as bytestring.

I compared the result from XML signed (xades-bes) and what get_serial_number() it's ok.
which schema file got it ?

I think you implemented the legacy IssuerSerial

See the schema of IssuerSerialV2

Just saw our latest commit, the object itself is der encoded, not one of it's members...

signxml/xades/__init__.py

blaggacao · 2019-12-16T01:20:46Z

signxml/xades/__init__.py

            usp  := UnignedSignatureProperties,     c. 4.3.6
            udop := UnignedDataObjectProperties,    c. 4.3.7
+
+        Electronic signature forms elements


"Electronic signature grammar (I guess that's what it is) by mode"

term used https://www.etsi.org/deliver/etsi_ts/101900_101999/101903/01.04.02_60/ts_101903v010402p.pdf at 4.4

I'm ok with that, just those ? look a little grammar-ish. But yep, in xml, that is probably not a common usage of a word...

blaggacao · 2019-12-16T01:21:05Z

signxml/xades/__init__.py

            udop := UnignedDataObjectProperties,    c. 4.3.7
+
+        Electronic signature forms elements
+        Mention differences between nodes


nodes -> modes

signxml/xades/__init__.py

blaggacao · 2019-12-16T01:22:18Z

signxml/xades/__init__.py

        return XADES132.QualifyingProperties(*qp_elements, **qp_attributes)
+
+
+class XAdESEPESSigner(XAdESSigner):


Might be an excellent idea, I have to think around it a bit.. Thanks 👍

blaggacao · 2019-12-16T01:24:22Z

@ovnicraft Thanks a lot for your PR! I'll have a look asap, and meanwhile I should probably reconfigure the commitlinter 😉 - until then, let's ignore him.

ghost · 2019-12-16T07:15:42Z

There were the following issues with this Pull Request

Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty
Commit: fefd820
- ✖ message may not be empty
- ✖ type may not be empty
Commit: f6db4d4
- ✖ message may not be empty
- ✖ type may not be empty
Commit: 57f3cd8
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

blaggacao · 2019-12-17T16:01:39Z

@ovnicraft I thought a little about the class base implemnetaiton of the different signature modes. I like the idea, it's hackable. Not sure if you've seen it, I've put a (still) unused enum at the beginning of the file, it was intended to server as a type switch aprameter for a mdoe dispatcher, with your prob=osal that would be a class dispatcher based on the enum, what do you think?

blaggacao

Still a spec inconsistency about IssuerServialV2

Or am I missign something?

blaggacao · 2019-12-17T16:03:31Z

signxml/xades/__init__.py

                serial_element = XADES132.IssuerSerialV2(
-                    # TODO implement, wtf?
+                    DS.X09IssuerName(issuer_string(cert)),
+                    DS.X509SerialNumber(b64encode(_der.encode_der_integer(cert.get_serial_number())))


The spec is something like:
XADES132.IssuerSerialV2(b64encode(_der.encode...(asn_obj)))

IMO must defined from DS.X509SerialNumber element wil double check

ghost · 2019-12-18T18:25:00Z

There were the following issues with this Pull Request

Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty
Commit: fefd820
- ✖ message may not be empty
- ✖ type may not be empty
Commit: f6db4d4
- ✖ message may not be empty
- ✖ type may not be empty
Commit: 87eb612
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

blaggacao

The ASN object still is not the one required... :( - I feel you are close! 😉

blaggacao · 2019-12-18T18:27:13Z

signxml/xades/__init__.py

                serial_element = XADES132.IssuerSerialV2(
-                    DS.X09IssuerName(issuer_string(cert)),
-                    DS.X509SerialNumber(f"cert.get_serial_number()")
+                    b64encode(_der.encode_der_integer(cert.get_serial_number()))


Well, that's not the ASN object required here, it's the IssuerSerial object...

I read this:
https://www.pyopenssl.org/en/stable/api/crypto.html#OpenSSL.crypto.X509.get_serial_number
I am calling get_serial_number()
Certificate has:

issuer

issuer serial number

I see:

Returns: The serial number.

Return type: int

But what needs DER encoding is this RFC IssuerSerial ASN object

IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber }

taken from: https://tools.ietf.org/html/rfc5035

GeneralNames can be quite some different objects, but I haven't yet analyzed how that poses encoding challenges...

Please note also: it seems to be a sequence, or array of unnamed objects (if I understand the ASN spec grammar correctly).

IMO DER representation must be done at application (signxml) level; so pyopenssl and cryptography provide API to solve this. AFAIK i do it.

IssueSerial comes from certificate from pyopenssl in 2 objects

SerialName

SerialNumber

Here we need to identify what needs the V2 on new spec; in legacy they has 2 elements on XML and i understood in V2 just one: SerialNumber

You can check my PR X509Name class and my own implementation to reverse get_components()

In terms of X509 Object all Issue serial is represented by:

as RFC mentioned defined.

Why not construe the mentioned ASN object using some ASN generator? (pyasn.1 - I guess) - and then DER encode through one of the APIs you mention.

Or could you point me to the pyopenssl IssuerSerial object? I haven't seen it. Is it a sequence as the spec mandates?

As for the name string, what's the difference between your implementation and https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Name.rfc4514_string ?

ghost · 2020-06-06T02:07:11Z

There were the following issues with this Pull Request

Commit: fd15c36
- ✖ message may not be empty
- ✖ type may not be empty
Commit: 1005ede
- ✖ message may not be empty
- ✖ type may not be empty
Commit: fefd820
- ✖ message may not be empty
- ✖ type may not be empty
Commit: f6db4d4
- ✖ message may not be empty
- ✖ type may not be empty
Commit: 87eb612
- ✖ message may not be empty
- ✖ type may not be empty

You may need to change the commit messages to comply with the repository contributing guidelines.

🤖 This comment was generated by commitlint[bot]. Please report issues here.

Happy coding!

David Arnold and others added 2 commits November 20, 2019 10:51

WIP WIP

fd15c36

[ADD] issuer info

1005ede

TODO: has a bug with public_bytes() in next lines

[IMP] correct alg for cert digest

fefd820

ovnicraft mentioned this pull request Dec 15, 2019

WIP: xades (ETSI) implementation XML-Security/signxml#139

Closed

14 tasks

[IMP] PoC extending classes based on xades forms

f6db4d4

blaggacao reviewed Dec 16, 2019

View reviewed changes

blaggacao requested changes Dec 17, 2019

View reviewed changes

[IMP] b64 - DER encoding for serial_number

87eb612

ovnicraft force-pushed the xades branch from 57f3cd8 to 87eb612 Compare December 18, 2019 18:24

blaggacao requested changes Dec 18, 2019

View reviewed changes

Deiber force-pushed the master branch from fd15c36 to f53f975 Compare December 19, 2019 19:36

Merge branch 'master' into xades

d3f57f8

		return XADES132.QualifyingProperties(qp_elements, *qp_attributes)


		class XAdESEPESSigner(XAdESSigner):

[ADD] issuer info #1

Are you sure you want to change the base?

[ADD] issuer info #1

Uh oh!

Conversation

ovnicraft commented Dec 15, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Dec 15, 2019

Uh oh!

ghost commented Dec 15, 2019

Uh oh!

ghost commented Dec 16, 2019

Uh oh!

blaggacao left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao Dec 17, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao commented Dec 16, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Dec 16, 2019

Uh oh!

blaggacao commented Dec 17, 2019

Uh oh!

blaggacao left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost commented Dec 18, 2019

Uh oh!

blaggacao left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao Dec 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao Dec 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao Dec 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blaggacao Dec 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ovnicraft commented Dec 15, 2019 •

edited

Loading

blaggacao Dec 17, 2019 •

edited

Loading

blaggacao commented Dec 16, 2019 •

edited

Loading

blaggacao left a comment •

edited

Loading

blaggacao left a comment •

edited

Loading

blaggacao Dec 18, 2019 •

edited

Loading

blaggacao Dec 18, 2019 •

edited

Loading

blaggacao Dec 18, 2019 •

edited

Loading

blaggacao Dec 18, 2019 •

edited

Loading

blaggacao Dec 23, 2019 •

edited

Loading