verify pass on iOS with any bogus message

thomashagstrom commented 3 years ago

When verifying using either RSA or RSAKeychain on iOS any totally bogus message will pass as true. Completely unreliable.

export const VerifyKeyChain = async (messageSignature, message) => {
  try {
    console.log('@@ rsaManager.VerifyKeyChain');
    console.log('MESSAGE SIGNATURE', messageSignature);
    console.log('MESSAGE', message);
    const verification = await RSAKeychain.verify(
      messageSignature,
      message,
      keyTag,
    );
    console.log('rsaManager VERIFICATION', verification);
    return verification;
  } catch (error) {
    console.warn(error);
  }
};

        const message = `${uuid.toString()};${timeStamp};${publicKey}`;
        const signature = response.data?.signature;

        console.log(`**** **** VERIFY SERVER SIGNATURE ******`);
        console.log('MESSAGE', message);
        console.log('SERVER SIGNATURE DATA', signature);

          console.log('>> VerifyKeyChain');
          const verified = await rsaManager.VerifyKeyChain(
            signature,
            'totally BOGUS??',
          );
          console.log('VerifyKeyChain', verified.toString().toUpperCase());

thomashagstrom commented 3 years ago

Same thing with RSA.verify64WithAlgorithm

          const algorithm = RSA.SHA256withRSA;
          const signature = response.data?.signature;
          const publicKey = await rsaManager.WriteKeyChainPair();
          console.log('>> verify64WithAlgorithm: ' + 'totally BOGUS??');
          const verified = await RSA.verify64WithAlgorithm(
            signature,
            'totally BOGUS??',
            publicKey,
            algorithm,
          );
          console.log(
            'verify64WithAlgorithm',
            verified.toString().toUpperCase(),
          );