[openssl/openssl] 58f032: cms: fix AuthEnvelopedData authAttrs tags and veri...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 58f032a04254baab114449e018eb7eaff6e4f648
      https://github.com/openssl/openssl/commit/58f032a04254baab114449e018eb7eaff6e4f648
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-13 (Mon, 13 Jul 2026)

  Changed paths:
    M crypto/cms/cms_asn1.c
    M crypto/cms/cms_env.c
    M crypto/cms/cms_local.h
    M crypto/cms/cms_smime.c
    M test/recipes/80-test_cms.t
    A test/recipes/80-test_cms_data/authenveloped_attrs.pem
    A test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem

  Log Message:
  -----------
  cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AAD

The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.

With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.

RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.

Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.

Closes #31635
Closes #26101
Closes #31629

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jul 13 14:41:34 2026
(Merged from https://github.com/openssl/openssl/pull/31695)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/f1be99-58f032%40github.com.