@@ -379,19 +379,11 @@ def sign(self, data, key=None, passphrase=None, cert=None, reference_uri=None, k
379379 signature = key .sign (signed_info_c14n , padding = PKCS1v15 (), algorithm = hash_alg )
380380 else :
381381 raise NotImplementedError ()
382- if self .sign_alg .startswith ("dsa-" ):
383- # Note: The output of the DSA signer is a DER-encoded ASN.1 sequence of two DER integers.
384- from asn1crypto .algos import DSASignature
385- decoded_signature = DSASignature .load (signature ).native
386- r = decoded_signature ['r' ]
387- s = decoded_signature ['s' ]
388- signature = long_to_bytes (r ).rjust (32 , b"\0 " ) + long_to_bytes (s ).rjust (32 , b"\0 " )
389- elif self .sign_alg .startswith ("ecdsa-" ):
390- # Note: The output of the ECDSA signer is a DER-encoded ASN.1 sequence of two DER integers.
382+ if self .sign_alg .startswith ("dsa-" ) or self .sign_alg .startswith ("ecdsa-" ):
383+ # Note: The output of the DSA and ECDSA signers is a DER-encoded ASN.1 sequence of two DER integers.
391384 (r , s ) = utils .decode_dss_signature (signature )
392385 int_len = key .key_size // 8
393- signature = long_to_bytes (r , blocksize = int_len )
394- signature += long_to_bytes (s , blocksize = int_len )
386+ signature = long_to_bytes (r , blocksize = int_len ) + long_to_bytes (s , blocksize = int_len )
395387
396388 signature_value_element .text = ensure_str (b64encode (signature ))
397389
@@ -575,9 +567,9 @@ def _verify_signature_with_pubkey(self, signed_info_c14n, raw_signature, key_val
575567 y = self ._get_long (dsa_key_value , "Y" )
576568 pn = dsa .DSAPublicNumbers (y = y , parameter_numbers = dsa .DSAParameterNumbers (p = p , q = q , g = g ))
577569 key = pn .public_key (backend = default_backend ())
578- from asn1crypto . algos import DSASignature
579- sig_as_der_seq = DSASignature . from_p1363 (raw_signature ). dump ( )
580- key .verify (sig_as_der_seq ,
570+ # TODO: supply meaningful key_size_bits for signature length assertion
571+ dss_signature = self . _encode_dss_signature (raw_signature , len ( raw_signature ) * 8 / 2 )
572+ key .verify (dss_signature ,
581573 data = signed_info_c14n ,
582574 algorithm = self ._get_signature_digest_method (signature_alg ))
583575 elif "rsa-" in signature_alg :
0 commit comments