Merge pull request #137 from SINC-GmbH/fix_for_sha256-rsa-MGF_support

extend SignatureAlgorithms of sha256-rsa-MGF

Author: Revsgaard

src/ITfoxtec.Identity.Saml2/Cryptography/Saml2Signer.cs

@@ -20,6 +20,7 @@ static Saml2Signer()
             CryptoConfig.AddAlgorithm(typeof(RSAPKCS1SHA256SignatureDescription), Saml2SecurityAlgorithms.RsaSha256Signature);
             CryptoConfig.AddAlgorithm(typeof(RSAPKCS1SHA384SignatureDescription), Saml2SecurityAlgorithms.RsaSha384Signature);
             CryptoConfig.AddAlgorithm(typeof(RSAPKCS1SHA512SignatureDescription), Saml2SecurityAlgorithms.RsaSha512Signature);
+            CryptoConfig.AddAlgorithm(typeof(RSAPSSSHA256SignatureDescription), Saml2SecurityAlgorithms.RsaPssSha256Signature);
         }
 #endif
 

src/ITfoxtec.Identity.Saml2/Cryptography/SignatureAlgorithm.cs

@@ -23,8 +23,12 @@ public static void ValidateAlgorithm(string signatureAlgorithm)
             {
                 return;
             }
+            else if (Saml2SecurityAlgorithms.RsaPssSha256Signature.Equals(signatureAlgorithm, StringComparison.InvariantCulture))
+            {
+                return;
+            }
+            throw new NotSupportedException($"Only SHA1 ({Saml2SecurityAlgorithms.RsaSha1Signature}), SHA256 ({Saml2SecurityAlgorithms.RsaSha256Signature}), SHA384 ({Saml2SecurityAlgorithms.RsaSha384Signature}), SHA512 ({Saml2SecurityAlgorithms.RsaSha512Signature}) and Sha256 Rsa MGF1 ({Saml2SecurityAlgorithms.RsaPssSha256Signature}) is supported.");
 
-            throw new NotSupportedException($"Only SHA1 ({Saml2SecurityAlgorithms.RsaSha1Signature}), SHA256 ({Saml2SecurityAlgorithms.RsaSha256Signature}), SHA384 ({Saml2SecurityAlgorithms.RsaSha384Signature}) and SHA512 ({Saml2SecurityAlgorithms.RsaSha512Signature}) is supported.");
         }
 
         public static string DigestMethod(string signatureAlgorithm)
@@ -45,11 +49,15 @@ public static string DigestMethod(string signatureAlgorithm)
             {
                 return Saml2SecurityAlgorithms.Sha512Digest;
             }
+            else if (Saml2SecurityAlgorithms.RsaPssSha256Signature.Equals(signatureAlgorithm, StringComparison.InvariantCulture))
+            {
+                return Saml2SecurityAlgorithms.Sha256Digest;
+            }
             else
             {
                 ValidateAlgorithm(signatureAlgorithm);
                 throw new InvalidOperationException();
-            }
+            }            
         }
     }
 }

src/ITfoxtec.Identity.Saml2/Cryptography/SignatureDescriptions/RSAPSSSHA256SignatureDescription.cs

@@ -0,0 +1,83 @@
+using System.Security.Cryptography;
+
+namespace ITfoxtec.Identity.Saml2.Cryptography
+{
+    public class RSAPSSSHA256SignatureDescription : SignatureDescription
+    {
+        public RSAPSSSHA256SignatureDescription()
+        {
+            using (var rsa = RSA.Create())
+            {
+                this.KeyAlgorithm = rsa.GetType().AssemblyQualifiedName; // Does not like a simple algorithm name, but wants a type name (AssembyQualifiedName in Core)
+            }
+           
+            this.DigestAlgorithm = "SHA256"; // Somehow wants a simple algorithm name
+            this.FormatterAlgorithm = typeof(RsaPssSignatureFormatter).FullName;
+            this.DeformatterAlgorithm = typeof(RsaPssSignatureDeformatter).FullName;
+        }
+
+        public override AsymmetricSignatureFormatter CreateFormatter(AsymmetricAlgorithm key)
+        {
+            var signatureFormatter = new RsaPssSignatureFormatter();
+            signatureFormatter.SetKey(key);
+            signatureFormatter.SetHashAlgorithm(this.DigestAlgorithm);
+            return signatureFormatter;
+        }
+
+        public override AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgorithm key)
+        {
+            var signatureDeformatter = new RsaPssSignatureDeformatter();
+            signatureDeformatter.SetKey(key);
+            signatureDeformatter.SetHashAlgorithm(this.DigestAlgorithm);
+            return signatureDeformatter;
+        }
+
+        public class RsaPssSignatureFormatter : AsymmetricSignatureFormatter
+        {
+            private RSA Key { get; set; }
+            private string HashAlgorithmName { get; set; }
+
+            public override void SetKey(AsymmetricAlgorithm key)
+            {
+                this.Key = (RSA)key;
+            }
+
+            public override void SetHashAlgorithm(string strName)
+            {
+                // Verify the name
+                Oid.FromFriendlyName(strName, OidGroup.HashAlgorithm);
+
+                this.HashAlgorithmName = strName;
+            }
+
+            public override byte[] CreateSignature(byte[] rgbHash)
+            {
+                return this.Key.SignHash(rgbHash, new HashAlgorithmName(this.HashAlgorithmName), RSASignaturePadding.Pss);
+            }
+        }
+
+        public class RsaPssSignatureDeformatter : AsymmetricSignatureDeformatter
+        {
+            private RSA Key { get; set; }
+            private string HashAlgorithmName { get; set; }
+
+            public override void SetKey(AsymmetricAlgorithm key)
+            {
+                this.Key = (RSA)key;
+            }
+
+            public override void SetHashAlgorithm(string strName)
+            {
+                // Verify the name
+                Oid.FromFriendlyName(strName, OidGroup.HashAlgorithm);
+
+                this.HashAlgorithmName = strName;
+            }
+            
+            public override bool VerifySignature(byte[] rgbHash, byte[] rgbSignature)
+            {
+                return this.Key.VerifyHash(rgbHash, rgbSignature, new HashAlgorithmName(this.HashAlgorithmName), RSASignaturePadding.Pss);
+            }
+        }
+    }
+}

src/ITfoxtec.Identity.Saml2/Schemas/Saml2SecurityAlgorithms.cs

@@ -37,6 +37,9 @@ public static class Saml2SecurityAlgorithms
         /// URI for the RSA-SHA-512 signature method for signing XML.
         /// </summary>
         public const string RsaSha512Signature = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512";
-
+        /// <summary>
+        /// URI for the sha256-rsa-mgf1 signature method for signing XML.
+        /// </summary>
+        public const string RsaPssSha256Signature = "http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1";
     }
 }