Support non-raw verification of client certificate verify
@@ -1161,6 +1161,18 @@ static void verifyCertificateVerify(TlsContext context, CertificateRequest certi
{
// Verify the CertificateVerify message contains a correct signature.
try
+ {
+ TlsVerifier verifier = certificate.getCertificateAt(0)
+ .createVerifier(TlsUtils.getSignatureAlgorithmClient(certificateType));
+ TlsStreamVerifier streamVerifier = verifier.getStreamVerifier(certificateVerify);
+
+ boolean verified;
+ if (streamVerifier != null)
+ {
+ handshakeHash.copyBufferTo(streamVerifier.getOutputStream());
+ verified = streamVerifier.isVerified();
+ }
+ else
{
SignatureAndHashAlgorithm signatureAlgorithm = certificateVerify.getAlgorithm();
@@ -1175,10 +1187,10 @@ static void verifyCertificateVerify(TlsContext context, CertificateRequest certi
hash = context.getSecurityParameters().getSessionHash();
}
- TlsVerifier verifier = certificate.getCertificateAt(0)
- .createVerifier(TlsUtils.getSignatureAlgorithmClient(certificateType));
+ verified = verifier.verifyRawSignature(certificateVerify, hash);
+ }
- if (!verifier.verifyRawSignature(certificateVerify, hash))
+ if (!verified)
{
throw new TlsFatalAlert(AlertDescription.decrypt_error);
}
@@ -1217,10 +1229,10 @@ static DigitallySigned generateServerKeyExchangeSignature(TlsContext context, Tl
return new DigitallySigned(algorithm, signature);
}
- static void verifyServerKeyExchangeSignature(TlsContext context, TlsVerifier tlsVerifier, DigestInputBuffer buf,
+ static void verifyServerKeyExchangeSignature(TlsContext context, TlsVerifier verifier, DigestInputBuffer buf,
DigitallySigned signedParams) throws IOException
{
- TlsStreamVerifier streamVerifier = tlsVerifier.getStreamVerifier(signedParams);
+ TlsStreamVerifier streamVerifier = verifier.getStreamVerifier(signedParams);
boolean verified;
if (streamVerifier != null)
@@ -1231,7 +1243,7 @@ static void verifyServerKeyExchangeSignature(TlsContext context, TlsVerifier tls
else
{
byte[] hash = TlsUtils.calculateSignatureHash(context, signedParams.getAlgorithm(), buf);
- verified = tlsVerifier.verifyRawSignature(signedParams, hash);
+ verified = verifier.verifyRawSignature(signedParams, hash);
}
if (!verified)
