fix: Correct the signature length check for ECDSA keys supplied via PKCS#11

An ASN.1 DER encoded signature is specified by RFC 3279 as:
Ecdsa-Sig-Value ::= SEQUENCE  {
    r     INTEGER,
    s     INTEGER
}

ASN.1 gives an overhead of 6 bytes (SEQUENCE and INTEGER tags + length) and
for P-256 "r" and "s" are 32 bytes each. This gives a minimum length of 70
bytes. "r" and "s" should be positive numbers so if the numbers are negative
(msb is 1), the numbers need to be padded, i.e. they will use 33 bytes
instead of 32. This means the encoded signature can be 71 or 72 bytes
depending on padding.

Ticket: MEN-7941
Changelog: Title

Signed-off-by: John Olav Lund <[email protected]>

Author: jo-lund

artifact/signer.go

@@ -78,7 +78,8 @@ func (r *RSA) Verify(message, sig []byte, key interface{}) error {
 // ECDSA Crypto interface implementation
 const ecdsa256curveBits = 256
 const ecdsa256keySize = 32
-const ecdsa256Asn1SizeBytes = 72
+const ecdsa256Asn1SizeBytes = 70
+const ecdsa256Asn1Padding = 2
 
 type ECDSA256 struct{}
 
@@ -171,15 +172,14 @@ func UnmarshalECDSASignature(sig []byte) (r, s *big.Int, e error) {
 	// in case of a key supplied via PKCS#11 URI, we have no control over what the signature is
 	// since it is designed to be actually verified via the same mechanism (PKCS#11 URI).
 	// We know here that it is ECDSA key, and judging form the size we can assume
-	// that it is ASN.1 encoded. If so, then it should be 72 bytes, the less or equal is here
-	// to support keys of size 71 bytes (strangely seen in the wild). In other words:
+	// that it is ASN.1 encoded. If so, then it should be between 70 and 72 bytes.
+	// In other words:
 	// if the signature has not been created with MarshalECDSASignature, then we assume
 	// it is to be decoded via ASN.1, with the protection on the signature length.
-	if len(sig) == ecdsa256Asn1SizeBytes ||
-		len(sig) == ecdsa256Asn1SizeBytes-1 {
+	if len(sig) >= ecdsa256Asn1SizeBytes &&
+		len(sig) <= ecdsa256Asn1SizeBytes+ecdsa256Asn1Padding {
 		return UnmarshalECDSASignatureASN1(sig)
 	}
-
 	return nil, nil, errors.Errorf("signer: invalid signature length: %d. "+
 		"For ECDSA only P-256 is supported.", len(sig))
 }