Proper 34.10 signature is R||S

diff --git a/gyac/yacpki/cer.go b/gyac/yacpki/cer.go
index c3675c8a286adfb95181402bc3b52e7ab44842b36f04cc98694d45fd3ddf31eb..1c83c083e13466bdd37e867264be70a85feb3e3d25564e59da4faf850060fcbb 100644 (file)
--- a/gyac/yacpki/cer.go
+++ b/gyac/yacpki/cer.go
@@ -141,8 +141,10 @@ func (cer *CerLoad) CheckSignature(signed, signature []byte) (err error) {
                }
                hasher := HasherByKeyAlgo(pub.A)
                utils.MustWrite(hasher, signed)
+               hsh := hasher.Sum(nil)
                var valid bool
-               valid, err = pk.VerifyDigest(hasher.Sum(nil), signature)
+               valid, err = pk.VerifyDigest(hsh,
+                       append(signature[len(signature)/2:], signature[:len(signature)/2]...))
                if !valid {
                        err = ErrSigInvalid
                }

diff --git a/gyac/yacpki/signed-data.go b/gyac/yacpki/signed-data.go
index 7a69ff5426911ee6ce0de57eb928f548246e03fc87732802d34c0dbb7453d5ee..ce6f7f875a6f06a3756ebfce52ecb0b2d35e641be1d1fa5645f4aca80ce9c010 100644 (file)
--- a/gyac/yacpki/signed-data.go
+++ b/gyac/yacpki/signed-data.go
@@ -133,8 +133,8 @@ func (sd *SignedData) SignWith(parent *CerLoad, prv crypto.Signer, sigTBS SigTBS
        hasher := HasherByKeyAlgo(parent.Pub[0].A)
        utils.MustWrite(hasher, gyac.EncodeItem(nil, gyac.ItemFromGo(sdTBS)))
        sig.Sign.A = parent.Pub[0].A
-       var err error
-       sig.Sign.V, err = prv.Sign(rand.Reader, hasher.Sum(nil), nil)
+       s, err := prv.Sign(rand.Reader, hasher.Sum(nil), nil)
+       sig.Sign.V = append(s[len(s)/2:], s[:len(s)/2]...)
        if err != nil {
                return err
        }

diff --git a/spec/format/signed-data.texi b/spec/format/signed-data.texi
index e5de4460697413170e62870a06fb28305e44fd1a040cd8ef1577199f1e4aa321..f9f52d97e18d7801c89c7f6199e9d0f292c6fd943b23d3f9bb2ee292e8380309 100644 (file)
--- a/spec/format/signed-data.texi
+++ b/spec/format/signed-data.texi
@@ -35,7 +35,7 @@ help creating the whole verification chain. They are placed outside
 
 GOST R 34.10-2012 must be used with Streebog (GOST R 34.11-2012) hash
 function. Its digest must be big-endian serialised. Public key must be
-in @code{BE(X)||BE(Y)} format. Signature is in @code{BE(S)||BE(R)}
+in @code{BE(X)||BE(Y)} format. Signature is in @code{BE(R)||BE(S)}
 format.
 
 Following algorithm identifiers are acceptable for the hash: