remove references to weak algorithms

microsoft · Dec 28, 2024 · 848f36b · 848f36b
1 parent 2b2f2a5
commit 848f36b
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 10 deletions.
diff --git a/CoseHandler.Tests/CoseX509ThumbprintTests.cs b/CoseHandler.Tests/CoseX509ThumbprintTests.cs
@@ -48,6 +48,6 @@ public void ConstructThumbprintWithAlgo()
     [ExpectedException(typeof(CoseX509FormatException))]
     public void ConstructThumbprintWithUnsupportedAlgo()
     {
-        _ = new CoseX509Thumprint(SelfSignedCert1, HashAlgorithmName.MD5);
+        _ = new CoseX509Thumprint(SelfSignedCert1, HashAlgorithmName.SHA3_512);
     }
 }
diff --git a/CoseIndirectSignature.Tests/IndirectSignatureFactoryTests.cs b/CoseIndirectSignature.Tests/IndirectSignatureFactoryTests.cs
@@ -201,20 +201,20 @@ public async Task TestCreateIndirectSignatureBytesHashProvidedAsync()
     }
 
     [Test]
-    public void TestCreateIndirectSignatureMd5Failure()
+    public void TestCreateIndirectSignatureUnsupportedAlgorithmFailure()
     {
-        Action act = () => { IndirectSignatureFactory factory = new(HashAlgorithmName.MD5); };
+        Action act = () => { IndirectSignatureFactory factory = new(HashAlgorithmName.SHA3_384); };
         act.Should().Throw<ArgumentException>();
     }
 
     [Test]
-    public void TestCreateIndirectSignatureMd5HashProvidedFailure()
+    public void TestCreateIndirectSignatureUnsupportedAlgorithmNameFailure()
     {
         ICoseSigningKeyProvider coseSigningKeyProvider = SetupMockSigningKeyProvider();
         using IndirectSignatureFactory factory = new();
         byte[] randomBytes = new byte[50];
         new Random().NextBytes(randomBytes);
-        using HashAlgorithm hasher = CoseSign1MessageIndirectSignatureExtensions.CreateHashAlgorithmFromName(HashAlgorithmName.MD5)
+        using HashAlgorithm hasher = CoseSign1MessageIndirectSignatureExtensions.CreateHashAlgorithmFromName(HashAlgorithmName.SHA3_384)
          ?? throw new Exception($"Failed to get hash algorithm from {nameof(CoseSign1MessageIndirectSignatureExtensions.CreateHashAlgorithmFromName)}");
         byte[] hash = hasher!.ComputeHash(randomBytes);
 

diff --git a/CoseIndirectSignature/IndirectSignatureFactory.cs b/CoseIndirectSignature/IndirectSignatureFactory.cs
@@ -601,8 +601,6 @@ private object CreateIndirectSignatureWithChecksInternalOldFormat(
     private static readonly ConcurrentDictionary<int, HashAlgorithmName> SizeInBytesToAlgorithm = new(
         new Dictionary<int, HashAlgorithmName>()
         {
-            { 16, HashAlgorithmName.MD5 },
-            { 20, HashAlgorithmName.SHA1 },
             { 32, HashAlgorithmName.SHA256 },
             { 48, HashAlgorithmName.SHA384 },
             { 64, HashAlgorithmName.SHA512 }

diff --git a/CoseSign1.Certificates.Tests/X509Certificate2SigningKeyProviderTests.cs b/CoseSign1.Certificates.Tests/X509Certificate2SigningKeyProviderTests.cs
@@ -30,7 +30,6 @@ public void TestConstructorsSuccess()
             new Action(() => _= new X509Certificate2CoseSigningKeyProvider(testCert)),
             new Action(() => _= new X509Certificate2CoseSigningKeyProvider(testCert, HashAlgorithmName.SHA256)),
             new Action(() => _= new X509Certificate2CoseSigningKeyProvider(testCert, HashAlgorithmName.SHA512)),
-            new Action(() => _= new X509Certificate2CoseSigningKeyProvider(testCert, HashAlgorithmName.SHA1)),
         ];
 
         // test validate

diff --git a/CoseSign1.Certificates/CoseX509Thumbprint.cs b/CoseSign1.Certificates/CoseX509Thumbprint.cs
@@ -18,7 +18,6 @@ public class CoseX509Thumprint
     /// </summary>
     private static readonly Dictionary<int, HashAlgorithmName> HashAlgorithmToCoseValues = new()
     {
-        { -14, HashAlgorithmName.SHA1 },
         { -16, HashAlgorithmName.SHA256 },
         { -43, HashAlgorithmName.SHA384 },
         { -44, HashAlgorithmName.SHA512 }
@@ -162,7 +161,6 @@ private void BuildHasher(int coseHashAlgorithmId)
 
         // HashAlgorithmName values are not constants, so we can't use an actual switch here.
         Hasher =
-            algName == HashAlgorithmName.SHA1 ? SHA1.Create() :
             algName == HashAlgorithmName.SHA256 ? SHA256.Create() :
             algName == HashAlgorithmName.SHA384 ? SHA384.Create() :
             algName == HashAlgorithmName.SHA512 ? SHA512.Create() :