Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for verifying S/MIME messages #12267

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Add support for verifying S/MIME messages #12267

wants to merge 6 commits into from
+675 −6

Conversation

nitneuqr
Copy link
Contributor

As promised in #11555, I'm opening this PR with an initial implementation of S/MIME verification, in order to better discuss the API design, and to start the reviews while I finish some other features.

Namely, the new pkcs7_verify functions do not handle the certificate verification feature as of now. It as similar to a openssl smime -verify with the -noverify flag, to verify the signature but not the certificates (similar to what #12116 needs). Can you point me towards some existing code verifying X.509 certificates, if some exists?

Also, I have one question about the certificate parameter in the functions: should we verify against one certificates? Multiple ones? All the ones that are stored in the signature (if any)?

My essential thoughts for testing were to do the round-trip: signature using the PKCS7SignatureBuilder and verifying using the pkcs_decrypt functions. For now, I've not replaced the test_support.pkcs7_verify function, but I'm planning to do so as soon as the certificate verification feature is developed.

I'm still new to rust, so please let me know if you see some issues in variable lifetime, or some unnecessary copying between Python & Rust.

cc @alex

@nitneuqr
PKCS7 signing (first version)
794db04 
no certificate verification as of now

handling PEM, DER, SMIME formats

added tests & documentation accordingly
@nitneuqr nitneuqr changed the title Add support for decrypting S/MIME messages Add support for verifying S/MIME messages Jan 10, 2025
@alex
Copy link
Member

alex commented Jan 10, 2025 via email

nitneuqr
nitneuqr commented Jan 10, 2025
View reviewed changes
src/cryptography/hazmat/primitives/serialization/pkcs7.py Outdated
raise ValueError(
"Malformed multipart/signed message: must be multipart"
)
if not isinstance(payload[0], email.message.Message):
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here, I'm not managing to create any test case (specific MIME message) that would raise this error. However, according to mypy, the case is still possible. Should I go with an assert in order to please mypy or have you got any idea on how the parts could be some text and not an email.message.Message?

@nitneuqr
Copy link
Contributor Author

@alex, for now I'm trying the following code:

def _verify_pkcs7_certificates(certificates: list[x509.Certificate]) -> None:
    builder = PolicyBuilder().store(Store(certificates))
    verifier = builder.build_client_verifier()
    verifier.verify(certificates[0], certificates[1:])

However, I'm getting the following error:

E       cryptography.hazmat.bindings._rust.x509.VerificationError: validation failed: basicConstraints.cA must not be asserted in an EE certificate (encountered processing <Certificate(subject=<Name(C=US,CN=cryptography CA)>, ...)>)

To be honest, I'm not clear as to what we are supposed to do in certificate verification. I've not found anything specific in the RFC, but I'll keep looking. If you can guide me through this, I'd love some help 🛩️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Tarnum-tst Tarnum-tst Tarnum-tst left review comments

@alex alex alex left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@nitneuqr @alex @Tarnum-tst