Replaced the CMS SignedData version-preservation property with a CMSSignedData.asVersion(int) method that returns a copy with the version field forced, so a producer (e.g. Authenticode needing version 1) can pin it explicitly per-instance while replaceSigners/addDigestAlgorithm keep recomputing the RFC 5652 version by default, relates to github #2344.

Author: dghgit

core/src/main/java/org/bouncycastle/util/Properties.java

@@ -294,17 +294,6 @@ public class Properties
      */
     public static final String BKS_MAX_IT_COUNT = "org.bouncycastle.bks.max_it_count";
 
-    /**
-     * When set to "true", {@code CMSSignedData.replaceSigners} / {@code addDigestAlgorithm}
-     * carry the original {@code SignedData} version over to the rebuilt structure verbatim
-     * instead of recomputing it. The default (unset / "false") recomputes the CMS version
-     * from the content, which is the correct behaviour per RFC 5652. The opt-in preserves a
-     * deliberately-set version for interop with producers that pin it - notably Microsoft
-     * Authenticode, whose signatures must stay at version 1 even though their non-{@code id-data}
-     * eContentType would otherwise compute to version 3. Relates to github #2344.
-     */
-    public static final String CMS_SIGNEDDATA_PRESERVE_VERSION = "org.bouncycastle.cms.signeddata.preserve_version";
-
     private Properties()
     {
     }

core/src/main/jdk1.4/org/bouncycastle/util/Properties.java

@@ -27,7 +27,6 @@ public class Properties
     public static final String PKCS12_IGNORE_USELESS_PASSWD = "org.bouncycastle.pkcs12.ignore_useless_passwd";
     public static final String PKCS12_MAX_IT_COUNT = "org.bouncycastle.pkcs12.max_it_count";
     public static final String BKS_MAX_IT_COUNT = "org.bouncycastle.bks.max_it_count";
-    public static final String CMS_SIGNEDDATA_PRESERVE_VERSION = "org.bouncycastle.cms.signeddata.preserve_version";
     public static final String X509_CRL_CACHE_TTL = "org.bouncycastle.x509.crl_cache_ttl";
     public static final String X509_ENABLE_CRLDP = "org.bouncycastle.x509.enableCRLDP";
     public static final String PKCS12_ALLOW_SUN_SECRET_KEYS = "org.bouncycastle.pkcs12.allow_sun_secret_keys";

docs/releasenotes.html

@@ -215,7 +215,7 @@ <h3>2.1.3 Additional Features and Functionality</h3>
 <li>ARIA-GCM/CCM and SM4-GCM/CCM can now be used as CMS content-encryption algorithms for AuthEnvelopedData. Previously only AES-GCM/CCM (and ChaCha20-Poly1305) were recognised as AEAD on the generate side, ARIA had no OID-addressable AEAD AlgorithmParameters, and SM4 had no GCM/CCM Cipher at all; an attempt to round-trip CMS AuthEnvelopedData under any of these failed. The BC provider now registers OID-addressable SM4-GCM/SM4-CCM Ciphers, AlgorithmParameters and AlgorithmParameterGenerators (GMObjectIdentifiers.sms4_gcm 1.2.156.10197.1.104.8 / sms4_ccm .104.9) and ARIA-GCM/CCM AlgorithmParameters/AlgorithmParameterGenerators (NSRIObjectIdentifiers.id_aria128/192/256_gcm and _ccm), the CMS encrypt path recognises all eight OIDs as AEAD and generates the correct RFC 5084 nonce/parameters for them, and the lightweight org.bouncycastle.crypto.util.CipherFactory / CipherKeyGeneratorFactory / AlgorithmIdentifierFactory recognise them too, so both the JCA/JCE (JceCMSContentEncryptorBuilder) and lightweight (BcCMSContentEncryptorBuilder) content-encryptor builders can now produce and recover CMS AuthEnvelopedData under ARIA-GCM/CCM and SM4-GCM/CCM. Decode-side recognition was added in the same release.</li>
 <li>CMS recipients can now be restricted to a set of acceptable content-encryption algorithms. The new fluent setter setAllowedContentAlgorithms(Set&lt;ASN1ObjectIdentifier&gt;) is available on all JCA/JCE recipients (JceKeyTransRecipient, JceKeyAgreeRecipient, JceKEMRecipient, JcePasswordRecipient, JceKEKRecipient) and all lightweight recipients (BcKeyTransRecipient, BcKEKRecipient, BcPasswordRecipient); when set, an attempt to recover content protected under any other content-encryption (or, for AuthenticatedData, content-MAC) algorithm is refused before any key unwrap or content processing, throwing the new org.bouncycastle.cms.CMSAlgorithmNotAllowedException (a subclass of CMSException, so existing catch blocks are unaffected). This lets a caller reject an attacker downgrading the content-encryption algorithm carried in the recipient info to a weaker one. The shared state and check live on a new common base class org.bouncycastle.cms.AbstractRecipient; with no allowed set configured (the default) behaviour is unchanged and every algorithm is accepted.</li>
 <li>CMS recipients can now require a minimum AEAD authentication tag size when recovering AuthEnvelopedData. The new fluent setter setMinimumTagSize(int tagSizeInBits) is available on the JCA/JCE recipients (JceKeyTransRecipient, JceKeyAgreeRecipient, JceKEMRecipient, JcePasswordRecipient, JceKEKRecipient); when set, recovering content whose AES-GCM/CCM content-encryption algorithm carries a shorter ICV tag is refused before any decryption, throwing the new org.bouncycastle.cms.CMSTagLengthException (a subclass of CMSException). This is a caller-chosen floor layered on top of the existing global org.bouncycastle.gcm.allow_short_tags policy, letting a recipient reject an attacker downgrading the tag length (e.g. to 32 or 64 bits). The check (on org.bouncycastle.cms.AbstractRecipient) is a no-op for non-AEAD content and when no minimum is set, so default behaviour is unchanged.</li>
-<li>CMSSignedData.replaceSigners() and addDigestAlgorithm() recompute the SignedData version from the content by default (the correct value per RFC 5652), but can now be told to carry the original version over verbatim by setting the org.bouncycastle.cms.signeddata.preserve_version system/security property (Properties.CMS_SIGNEDDATA_PRESERVE_VERSION) to "true". This is for interop with producers that pin the version irrespective of content - notably Microsoft Authenticode, whose signatures must stay at version 1 even though their non-id-data eContentType would otherwise compute to version 3. The org.bouncycastle.asn1.cms.SignedData structure gains a constructor taking an explicit ASN1Integer version for this purpose (issue #2344).</li>
+<li>CMSSignedData.replaceSigners() and addDigestAlgorithm() recompute the SignedData version from the content per RFC 5652 (a non-id-data eContentType, for example, computes to version 3). A producer that needs to pin a specific version can now call the new CMSSignedData.asVersion(int), which returns a copy of the message with the SignedData version field forced to the given value and everything else unchanged. This covers interop with profiles that require a fixed version irrespective of content - notably Microsoft Authenticode, whose signatures must carry version 1 even though their SPC_INDIRECT_DATA eContentType would otherwise compute to version 3. The org.bouncycastle.asn1.cms.SignedData structure gains a constructor taking an explicit ASN1Integer version to support this (issue #2344).</li>
 <li>The Argon2 password-based KDF (RFC 9106) is now available through the BC JCE provider as SecretKeyFactory "ARGON2", complementing the existing lightweight org.bouncycastle.crypto.generators.Argon2BytesGenerator. Parameters are supplied via the new org.bouncycastle.jcajce.spec.Argon2KeySpec (variant Argon2d/Argon2i/Argon2id, version 1.0/1.3, salt, iterations, memory cost in KiB, parallelism and output key length in bits, plus optional secret and additional data), following the style of the existing SCRYPT SecretKeyFactory and ScryptKeySpec. The attacker-cost guards on the lightweight generator still apply: the memory exponent is capped by org.bouncycastle.argon2.max_memory_exp (default 24, i.e. 16 GiB).</li>
 <li>The BCJSSE hostname verifier no longer falls back to matching the subject CN of a server certificate when the certificate carries no SubjectAltName dNSName entry; by default only a matching SAN dNSName (or, for an IP literal, an iPAddress SAN) satisfies HTTPS endpoint identification. RFC 9525 sec. 6.3 deprecates CN as a TLS server identifier and CAB Forum Baseline Requirements 7.1.4.2 require SAN dNSName entries for publicly-trusted server certs; the CN fallback was also a Name-Constraints bypass surface, as RFC 5280 name constraints only constrain SubjectAltName entries of the constrained type, so a dNSName-constrained sub-CA could issue a SAN-less leaf carrying an unrelated hostname in CN. The legacy SunJSSE-compatible CN matching remains available, as an opt-in for certificates that only identify the server via CN, by setting the org.bouncycastle.jsse.hostname_check_cn_fallback system/security property (Properties.JSSE_HOSTNAME_CHECK_CN_FALLBACK) to "true".</li>
 <li>PKIXNameConstraintValidator gains an opt-in relaxed directoryName matching mode for GSMA SGP.22 v2.5 (Remote SIM Provisioning) certificate chains, gated behind the new org.bouncycastle.x509.sgp22_name_constraints system property (default off). When enabled, a permitted-subtree RDN is satisfied by any matching subject RDN regardless of position, additional subject attributes beyond those named in the subtree are tolerated (SGP.22 sec. 4.5.2.1.0.2), and a serialNumber RDN is matched with a startsWith comparison wherever it appears (SGP.22 sec. 4.5.2.1.0.3). This is deliberately looser than the contiguous-prefix DN matching mandated by RFC 5280 sec. 7.1. A pre-existing, ungated SGP.22 serialNumber startsWith concession in the strict matching path has been moved behind the same property, so default validation is now fully RFC 5280 strict (a single serialNumber name constraint is compared by equality, not prefix, unless the property is set) (issue #2327).</li>

pkix/src/main/java/org/bouncycastle/cms/CMSSignedData.java

@@ -16,6 +16,7 @@
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.ASN1OctetString;
 import org.bouncycastle.asn1.ASN1Set;
@@ -32,7 +33,6 @@
 import org.bouncycastle.operator.DigestAlgorithmIdentifierFinder;
 import org.bouncycastle.operator.OperatorCreationException;
 import org.bouncycastle.util.Encodable;
-import org.bouncycastle.util.Properties;
 import org.bouncycastle.util.Store;
 
 /**
@@ -250,6 +250,29 @@ public int getVersion()
         return signedData.getVersion().intValueExact();
     }
 
+    /**
+     * Return a copy of this CMSSignedData with the SignedData version field forced to the given
+     * value, leaving every other field unchanged.
+     * <p>
+     * The version is normally recomputed from the content per RFC 5652 sec. 5.1 (for example, a
+     * non-id-data eContentType implies version 3), including by {@link #replaceSigners} and
+     * {@link #addDigestAlgorithm}. This method lets a producer pin a specific version for interop
+     * with profiles that require one - notably Microsoft Authenticode, whose signatures must carry
+     * version 1 even though their SPC_INDIRECT_DATA eContentType would otherwise compute to 3.
+     *
+     * @param version the CMSVersion value to set.
+     * @return a new CMSSignedData carrying the supplied version.
+     */
+    public CMSSignedData asVersion(int version)
+    {
+        SignedData current = this.signedData;
+        SignedData newContent = new SignedData(new ASN1Integer(version), current.getDigestAlgorithms(),
+            current.getEncapContentInfo(), current.getCertificates(), current.getCRLs(), current.getSignerInfos());
+
+        return new CMSSignedData(this.contentInfo.getContentType(), newContent, this.signedContent,
+            this.signerInfoStore);
+    }
+
     /**
      * return the collection of signers that are associated with the
      * signatures for the message.
@@ -566,7 +589,7 @@ public static CMSSignedData addDigestAlgorithm(CMSSignedData signedData, Algorit
 
         SignedData oldContent = signedData.signedData;
 
-        SignedData newContent = createSignedData(oldContent, digestSet, oldContent.getEncapContentInfo(),
+        SignedData newContent = new SignedData(digestSet, oldContent.getEncapContentInfo(),
             oldContent.getCertificates(), oldContent.getCRLs(), oldContent.getSignerInfos());
 
         return new CMSSignedData(signedData.contentInfo.getContentType(), newContent, signedData.getSignedContent(),
@@ -633,30 +656,13 @@ public static CMSSignedData replaceSigners(CMSSignedData signedData, SignerInfor
 
         SignedData oldContent = signedData.signedData;
 
-        SignedData newContent = createSignedData(oldContent, digestSet, oldContent.getEncapContentInfo(),
+        SignedData newContent = new SignedData(digestSet, oldContent.getEncapContentInfo(),
             oldContent.getCertificates(), oldContent.getCRLs(), signerSet);
 
         return new CMSSignedData(signedData.contentInfo.getContentType(), newContent, signedData.getSignedContent(),
             signerInformationStore);
     }
 
-    /**
-     * Rebuild a SignedData from an existing one, replacing the digest and/or signer sets. By
-     * default the CMS version is recomputed from the content (correct per RFC 5652); when
-     * {@link Properties#CMS_SIGNEDDATA_PRESERVE_VERSION} is set the original version is carried
-     * over verbatim, for interop with producers that pin it (e.g. Authenticode). See github #2344.
-     */
-    private static SignedData createSignedData(SignedData oldContent, ASN1Set digestSet, ContentInfo contentInfo,
-        ASN1Set certificates, ASN1Set crls, ASN1Set signerSet)
-    {
-        if (Properties.isOverrideSet(Properties.CMS_SIGNEDDATA_PRESERVE_VERSION))
-        {
-            return new SignedData(oldContent.getVersion(), digestSet, contentInfo, certificates, crls, signerSet);
-        }
-
-        return new SignedData(digestSet, contentInfo, certificates, crls, signerSet);
-    }
-
     private static void compareAndReplaceAlgIds(AlgorithmIdentifier[] oldDigestAlgIds, AlgorithmIdentifier[] newDigestAlgIds)
     {
         for (int i = 0; i != newDigestAlgIds.length; i++)

pkix/src/test/java/org/bouncycastle/cms/test/NewSignedDataTest.java

@@ -114,7 +114,6 @@
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.test.TestResourceFinder;
 import org.bouncycastle.util.CollectionStore;
-import org.bouncycastle.util.Properties;
 import org.bouncycastle.util.Store;
 import org.bouncycastle.util.encoders.Base64;
 import org.bouncycastle.util.io.Streams;
@@ -834,13 +833,12 @@ public static Test suite()
         return new CMSTestSetup(new TestSuite(NewSignedDataTest.class));
     }
 
-    public void testReplaceSignersPreservesVersion()
+    public void testAsVersion()
         throws Exception
     {
-        // Microsoft Authenticode signatures pin SignedData version 1 even though their
-        // eContentType (SPC_INDIRECT_DATA, not id-data) computes to version 3. By default
-        // replaceSigners / addDigestAlgorithm recompute the correct CMS version, but
-        // Properties.CMS_SIGNEDDATA_PRESERVE_VERSION opts in to carrying the original over.
+        // replaceSigners recomputes the CMS version per RFC 5652 (a non-id-data eContentType such
+        // as Authenticode's SPC_INDIRECT_DATA computes to version 3), but a producer can pin a
+        // specific version with CMSSignedData.asVersion(int) - e.g. Authenticode requires 1.
         // Regression test for github #2344.
         ASN1ObjectIdentifier spcIndirectData = new ASN1ObjectIdentifier("1.3.6.1.4.1.311.2.1.4");
 
@@ -856,41 +854,28 @@ public void testReplaceSignersPreservesVersion()
         gen.addSignerInfoGenerator(sigGenBuilder.build(sha1Signer, _origCert));
         gen.addCertificates(certs);
 
-        CMSSignedData generated = gen.generate(new CMSProcessableByteArray(spcIndirectData, "hello world".getBytes()), true);
+        CMSSignedData s = gen.generate(new CMSProcessableByteArray(spcIndirectData, "hello world".getBytes()), true);
 
-        // Rebuild the SignedData with the version forced to 1 (as Authenticode producers do),
-        // via raw ASN.1 so the fixture does not itself depend on the code path under test.
-        ASN1Sequence sdSeq = ASN1Sequence.getInstance(generated.toASN1Structure().getContent());
-        ASN1EncodableVector v = new ASN1EncodableVector();
-        v.add(new ASN1Integer(1));
-        for (int i = 1; i != sdSeq.size(); i++)
-        {
-            v.add(sdSeq.getObjectAt(i));
-        }
-        CMSSignedData authenticode = new CMSSignedData(
-            new ContentInfo(CMSObjectIdentifiers.signedData, new DLSequence(v)));
+        // a non-id-data eContentType yields version 3 both on generation and after replaceSigners.
+        assertEquals("generated version", 3, s.getVersion());
+        CMSSignedData replaced = CMSSignedData.replaceSigners(s, s.getSignerInfos());
+        assertEquals("replaceSigners recomputes to version 3", 3, replaced.getVersion());
 
-        assertEquals("fixture must start at version 1", 1, authenticode.getVersion());
+        // asVersion(1) pins the Authenticode version without disturbing anything else.
+        CMSSignedData pinned = replaced.asVersion(1);
+        assertEquals("asVersion pins the version", 1, pinned.getVersion());
 
-        // Default: recompute the correct CMS version (3 for a non-id-data eContentType).
-        CMSSignedData recomputed = CMSSignedData.replaceSigners(authenticode, authenticode.getSignerInfos());
-        assertEquals("default replaceSigners must recompute the version", 3, recomputed.getVersion());
+        // the content type, certificates and signer are untouched, and the signature still verifies.
+        assertEquals(spcIndirectData, pinned.getSignedContent().getContentType());
+        assertEquals(replaced.getCertificates().getMatches(null).size(), pinned.getCertificates().getMatches(null).size());
 
-        // Opt-in: preserve the original version verbatim.
-        System.setProperty(Properties.CMS_SIGNEDDATA_PRESERVE_VERSION, "true");
-        try
-        {
-            CMSSignedData preservedReplace = CMSSignedData.replaceSigners(authenticode, authenticode.getSignerInfos());
-            assertEquals("preserve flag must keep replaceSigners at version 1", 1, preservedReplace.getVersion());
+        SignerInformation signer = (SignerInformation)pinned.getSignerInfos().getSigners().iterator().next();
+        X509CertificateHolder cert = (X509CertificateHolder)pinned.getCertificates().getMatches(signer.getSID()).iterator().next();
+        assertTrue("signature valid after asVersion",
+            signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC).build(cert)));
 
-            CMSSignedData preservedAdd = CMSSignedData.addDigestAlgorithm(authenticode,
-                new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha512));
-            assertEquals("preserve flag must keep addDigestAlgorithm at version 1", 1, preservedAdd.getVersion());
-        }
-        finally
-        {
-            System.getProperties().remove(Properties.CMS_SIGNEDDATA_PRESERVE_VERSION);
-        }
+        // asVersion round-trips through an encode/decode.
+        assertEquals(1, new CMSSignedData(pinned.getEncoded()).getVersion());
     }
 
     public void setUp()

util/src/main/java/org/bouncycastle/asn1/cms/SignedData.java

@@ -120,12 +120,11 @@ public SignedData(
     }
 
     /**
-     * Construct a SignedData with an explicit, caller-supplied version rather than a
-     * recomputed one. This is for transforming an existing SignedData (e.g. replacing the
-     * signer set) where the original version must be carried over verbatim - recomputing it
-     * via {@link #calculateVersion} can change a value the producer set deliberately (for
-     * example Microsoft Authenticode signatures pin version 1 even though their eContentType
-     * is not id-data, which would otherwise compute to version 3).
+     * Construct a SignedData with an explicit, caller-supplied version rather than a recomputed
+     * one. This lets a producer pin a specific version for a profile that requires one - for
+     * example Microsoft Authenticode signatures pin version 1 even though their eContentType is
+     * not id-data, which {@link #calculateVersion} would otherwise map to version 3. The
+     * higher-level entry point is {@code CMSSignedData.asVersion(int)}.
      */
     public SignedData(
         ASN1Integer version,