search

dhensby / node-http-message-signatures

A node package for signing and verifying HTTP messages as per RFC 9421 - HTTP Message Signatures specification
ISC License
13 stars 8 forks source link

Malformed signature #165

Closed cedrick-ah closed 1 week ago

cedrick-ah commented 1 week ago

I got a Malformed signature error from Nodejs crypto module when I used the ecdsa-p256-sha256 algorithm.

Here is the full error:

Error: Malformed signature
    at Verify.verify (node:internal/crypto/sig:230:24)
    at Object.verifier [as verify] (/home/zotcha/Documents/dev/workspace/kryptapay/kryptapayp2p-service/node_modules/http-message-signatures/lib/algorithm/index.js:105:101)
    at /home/zotcha/Documents/dev/workspace/kryptapay/kryptapayp2p-service/node_modules/http-message-signatures/lib/httpbis/index.js:416:20
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async verifyCallbackMessage (/home/zotcha/Documents/dev/workspace/kryptapay/kryptapayp2p-service/src/helpers/mobile-money/pawapay.js:17:22)
    at async depositCallback (/home/zotcha/Documents/dev/workspace/kryptapay/kryptapayp2p-service/src/controllers/mobile-money/pawapay.js:107:32) {
  code: 'ERR_CRYPTO_OPERATION_FAILED'
}

I read this from Nodejs about the dsaEncoding then I tried changing the dsaEncoding in the createVerifier function from ieee-p1363 to der which solved the error. Is it possible to implement a functionality to pass an optional encoding parameter for algorithms that have multiple encodings?

I am in a case where the signer is not the verifier.

dhensby commented 1 week ago

The use of ieee-p1363 encoding of the signature is intentional and as per the spec as I understand it.

There are normative examples from the spec that form part of the test suite to ensure compliance.

Allowing other signature encodings would be contrary to the spec and potentially open security issues if we attempted to verify the signature as DER encoded. It is, of course, possible to provide the library with a custom verifier to enable what you're asking.