[openssl/openssl] 9a45b7: cms: fix AuthEnvelopedData authAttrs tags and veri...

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: 9a45b708e401c72461628a36225d776a78269eea
      https://github.com/openssl/openssl/commit/9a45b708e401c72461628a36225d776a78269eea
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M crypto/cms/cms_asn1.c
    M crypto/cms/cms_env.c
    M crypto/cms/cms_local.h
    M crypto/cms/cms_smime.c
    M test/recipes/80-test_cms.t
    A test/recipes/80-test_cms_data/authenveloped_attrs.pem
    A test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem

  Log Message:
  -----------
  cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AAD

The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the
X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs
and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF
Attribute, so use X509_ATTRIBUTE with the correct tags, matching the
STACK_OF(X509_ATTRIBUTE) members already declared in the structure.

With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the
authenticated attributes must also be fed to the content cipher as the AEAD
associated data required by RFC 5083 section 2.1. Encode their DER (with the
universal SET OF tag) for both encryption and decryption; without this the GCM
tag fails to verify against compliant senders such as BouncyCastle.

RFC 5083 also requires that plaintext is not released until its integrity has
been verified. The AEAD tag is only checked once all the ciphertext has been
processed, so buffer the decrypted content and forward it to the output BIO
only after that check succeeds; a tampered message then leaks nothing to -out.

Add an interop test using a BouncyCastle-generated AES-128-GCM message with
authenticated and unauthenticated attributes, plus a tampered copy that must
fail the tag check and leave -out empty.

Closes #31635
Closes #26101
Closes #31629

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Igor Ustinov <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merge-date: Fri Aug 21 10:37:36 2026
Merged-from: https://github.com/openssl/openssl/pull/32076



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/be7ac1-9a45b7%40github.com.