[openssl/openssl] d71c60: cms: fix AuthenticatedData authAttrs and unauthAtt...

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: d71c60e98e92701d4a488798235ef80a331e8970
      https://github.com/openssl/openssl/commit/d71c60e98e92701d4a488798235ef80a331e8970
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-29 (Wed, 29 Jul 2026)

  Changed paths:
    M crypto/cms/cms_asn1.c
    M test/recipes/80-test_cms.t
    A test/recipes/80-test_cms_data/authenticated_attrs.pem

  Log Message:
  -----------
  cms: fix AuthenticatedData authAttrs and unauthAttrs element type

The CMS_AuthenticatedData ASN.1 template declared the authAttrs and
unauthAttrs fields as X509_ALGOR, whereas per RFC 5652 section 9.1 they
are [2] and [3] IMPLICIT SET OF Attribute and the CMS_AuthenticatedData
structure already declares them as STACK_OF(X509_ATTRIBUTE). The implicit
tags [2] and [3] were already correct, so only the element type was wrong.

An Attribute (SEQUENCE { type, SET OF value }) is structurally accepted as
an AlgorithmIdentifier (SEQUENCE { algorithm, ANY OPTIONAL }), so parsing
did not fail; the attributes were merely misinterpreted, e.g. cms -cmsout
-print rendered them as algorithm/parameter instead of decoding them as
attributes. Use X509_ATTRIBUTE with the existing tags so the template
matches the structure.

Add a parse test using a BouncyCastle-generated AuthenticatedData message
carrying an authenticated and an unauthenticated attribute, asserting both
are decoded as SET OF Attribute.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
MergeDate: Wed Jul 29 10:51:03 2026
(Merged from https://github.com/openssl/openssl/pull/31960)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/c1b0e7-d71c60%40github.com.