Repository: randombit/botan
Pull request #2933 (2022-03-10 20:07:19)

Fix ecdsa_unit test failures when SHA-1 is not available
* Certificates used in `test_decode_ver_link_SHA1()` are signed with SHA-1, so disable the test case without SHA-1
* Use SHA-256 fingerprint in `test_decode_ecdsa_X509()`

Part of fixes for #2931


Patch:
diff --git a/src/build-data/policy/bsi.txt b/src/build-data/policy/bsi.txt
index 6cabe70d7..4cb157834 100644
--- a/src/build-data/policy/bsi.txt
+++ b/src/build-data/policy/bsi.txt
@@ -26,9 +26,6 @@ kdf1_iso18033
 sp800_108
 sp800_56c
 
-# pbkdf
-argon2
-
 # pk_pad
 eme_oaep
 emsa_pssr
@@ -45,8 +42,6 @@ ecgdsa
 ecies
 eckcdsa
 ecdh
-kyber
-kyber_90s
 xmss
 
 # rng
@@ -76,9 +71,6 @@ sha3_bmi2
 rdseed
 win32_stats
 
-# pbkdf
-argon2_ssse3
-
 # rng
 processor_rng
 system_rng
@@ -129,7 +121,7 @@ chacha_avx2
 ofb
 rc4
 salsa20
-#shake_cipher # not recommended, but needed for kyber
+shake_cipher
 
 # kdf
 hkdf
@@ -156,13 +148,13 @@ emsa_raw
 emsa_x931
 
 # hash
-#blake2 # not recommended, but needed for argon2
+blake2
 comb4p
 gost_3411
 md4
 md5
 rmd160
-#shake # not recommended, but needed for kyber
+shake
 skein
 #sha1 // needed for x509
 sm3
diff --git a/src/lib/base/symkey.h b/src/lib/base/symkey.h
index 091df18fc..990c7dde1 100644
--- a/src/lib/base/symkey.h
+++ b/src/lib/base/symkey.h
@@ -13,8 +13,6 @@
 
 namespace Botan {
 
-class RandomNumberGenerator;
-
 /**
 * Octet String
 */
@@ -75,7 +73,7 @@ class BOTAN_PUBLIC_API(2,0) OctetString final
       * @param rng is a random number generator
       * @param len is the desired length in bytes
       */
-      OctetString(RandomNumberGenerator& rng, size_t len);
+      OctetString(class RandomNumberGenerator& rng, size_t len);
 
       /**
       * Create a new OctetString
diff --git a/src/lib/filters/out_buf.h b/src/lib/filters/out_buf.h
index 0f5fc55be..d6efbdaf2 100644
--- a/src/lib/filters/out_buf.h
+++ b/src/lib/filters/out_buf.h
@@ -14,8 +14,6 @@
 #include <deque>
 
 namespace Botan {
-	
-class SecureQueue;
 
 /**
 * Container of output buffers for Pipe
@@ -28,7 +26,7 @@ class Output_Buffers final
       size_t get_bytes_read(Pipe::message_id) const;
       size_t remaining(Pipe::message_id) const;
 
-      void add(SecureQueue*);
+      void add(class SecureQueue*);
       void retire();
 
       Pipe::message_id message_count() const;
diff --git a/src/lib/x509/x509_obj.h b/src/lib/x509/x509_obj.h
index f121a76fc..8b11db29b 100644
--- a/src/lib/x509/x509_obj.h
+++ b/src/lib/x509/x509_obj.h
@@ -17,7 +17,6 @@ namespace Botan {
 class Public_Key;
 class Private_Key;
 class RandomNumberGenerator;
-class PK_Signer;
 
 /**
 * This class represents abstract X.509 signed objects as in the X.500
@@ -60,7 +59,7 @@ class BOTAN_PUBLIC_API(2,0) X509_Object : public ASN1_Object
       * @param tbs the tbs bits to be signed
       * @return signed X509 object
       */
-      static std::vector<uint8_t> make_signed(PK_Signer* signer,
+      static std::vector<uint8_t> make_signed(class PK_Signer* signer,
                                               RandomNumberGenerator& rng,
                                               const AlgorithmIdentifier& alg_id,
                                               const secure_vector<uint8_t>& tbs);


Test patch:
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index f0ccc08f8..e4881dc1f 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -86,8 +86,8 @@ Test::Result test_decode_ecdsa_X509()
 
    result.test_eq("serial number", cert.serial_number(), Botan::hex_decode("01"));
    result.test_eq("authority key id", cert.authority_key_id(), cert.subject_key_id());
-   result.test_eq("key fingerprint", cert.fingerprint("SHA-1"),
-                  "32:42:1C:C3:EC:54:D7:E9:43:EC:51:F0:19:23:BD:85:1D:F2:1B:B9");
+   result.test_eq("key fingerprint", cert.fingerprint("SHA-256"),
+                  "3B:6C:99:1C:D6:5A:51:FC:EB:17:E3:AA:F6:3C:1A:DA:14:1F:82:41:30:6F:64:EE:FF:63:F3:1F:D6:07:14:9F");
 
    std::unique_ptr<Botan::Public_Key> pubkey(cert.subject_public_key());
    result.test_eq("verify self-signed signature", cert.check_signature(*pubkey), true);
@@ -113,6 +113,15 @@ Test::Result test_decode_ver_link_SHA1()
 
    Test::Result result("ECDSA Unit");
    std::unique_ptr<Botan::Public_Key> pubkey(root_cert.subject_public_key());
+
+   auto sha1 = Botan::HashFunction::create("SHA-1");
+
+   if(!sha1)
+      {
+      result.confirm("verification of self-signed signature failed due to missing SHA-1",
+                     !link_cert.check_signature(*pubkey));
+      return result;
+      }
    result.confirm("verified self-signed signature", link_cert.check_signature(*pubkey));
    return result;
    }