Add RFC 9338 countersignature support - #74
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
It introduces a large amount of new security-sensitive parsing and validation logic for attacker-controlled CBOR/COSE structures that warrants careful human review beyond automated checks.
Pull request overview
Adds RFC 9338 countersignature (Countersignature / Countersignature0, V2 + legacy verify) support to wolfCOSE, extending the core COSE parser/validator and exposing new public APIs plus CLI/test/documentation coverage.
Changes:
- Introduces public countersignature creation/verification APIs and settings gates (
WOLFCOSE_COUNTERSIGN*), including in-place countersigning with overlap protection. - Extends header-label decoding/duplicate enforcement to support both integer and text labels (with UTF-8 validation), and tightens validation of skipped/nested COSE structures.
- Adds interoperability + unit tests, CLI commands, and build/CI gates/documentation updates for the new feature.
File summaries
| File | Description |
|---|---|
| tools/wolfcose_tool.c | Adds countersign / counterverify CLI commands and option parsing for detached payload + AAD + index selection. |
| tests/test_interop.c | Adds RFC 9338 Appendix A vectors and legacy RFC 8152 countersignature verification coverage. |
| tests/test_cose.c | Adds round-trip countersignature tests, in-place/overlap rejection tests, and strengthens duplicate-label rejection expectations. |
| tests/test_cbor.c | Adds UTF-8 boundary/invalid-sequence tests for wc_CBOR_DecodeLabel() text labels. |
| src/wolfcose.c | Implements countersignature parsing/creation/verification and expands header-label tracking/validation. |
| src/wolfcose_internal.h | Extends header-state bookkeeping to track integer vs text labels without allocation. |
| src/wolfcose_cbor.c | Adds UTF-8 validation for decoded text labels (tstr) used as map keys. |
| scripts/cmdline-test.sh | Adds CLI-level countersign round-trip + multi-countersignature index coverage. |
| README.md | Documents countersignature support at a high level in the project feature list. |
| Makefile | Adds a countersignature configuration-guard compile test target. |
| include/wolfcose/wolfcose.h | Adds countersignature types, header label defines (7/9/11/12), and public API declarations/docs. |
| include/wolfcose/settings.h | Adds build gates for countersign operations and enforces CBOR encode/decode dependencies. |
| docs/Message-Types.md | Adds a countersignature usage section and CLI examples. |
| docs/Macros.md | Documents new COUNTERSIGN extension macros and semantics. |
| docs/Getting-Started.md | Updates strictness notes around header label types/duplicate handling. |
| docs/API-Reference.md | Adds countersignature API reference entries and clarifies header label behavior. |
| .github/workflows/c99-compliance.yml | Runs the new countersign configuration gate in CI. |
Review details
- Files reviewed: 17/17 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #74
Scan targets checked: wolfcose-bugs, wolfcose-src
Findings: 1
Required changes (1)
wolfCose_EccSignRaw declaration guard not widened for countersignature signing
File: src/wolfcose_internal.h:321
Function: wolfCose_EccSignRaw
Category: API contract violations
src/wolfcose.c:854 now defines wolfCose_EccSignRaw() under WOLFCOSE_COUNTERSIGN_SIGN, but the WOLFCOSE_LOCAL declaration guard still lists only WOLFCOSE_SIGN1_SIGN/WOLFCOSE_SIGN_SIGN. In a countersign-only build (the config make countersign-config-test compiles) the definition has no prototype and loses hidden visibility, exporting an internal symbol from the shared library.
Related known finding #9884 (similar but distinct): Both involve wolfCose_EccSignRaw, but the candidate faults a mismatched preprocessor declaration guard that omits countersignature builds; #9884 faults length-dependent signature-buffer conversion operations. Their root causes and required patches are different.
Recommendation: Add || defined(WOLFCOSE_COUNTERSIGN_SIGN) to the declaration guard so it matches the definition guard in wolfcose.c.
Referenced code: src/wolfcose_internal.h:321-322 (2 lines)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
#3