aws
Manually validate rsa_pss certificate signature schemes
Problem:
The Openssl function used to parse signatures off certificates does not differentiate between any rsa_pss signature schemes.
The above openssl limitation means we cannot choose a subset of pss schemes for cert signature verification. This came up as an issue when adding a new security policy
https://github.com/aws/s2n-tls/blob/660091ff73029fc91c6578cdb450b85992ff9ef5/tls/s2n_security_policies.c#L1087-L1090
s2n uses Openssl to parse the certificate signatures off the certificates and add restrict certain insecure signatures. However the Openssl function x509_get_signature_nid() does not differentiate between rsa_pss certs and rsa_pss_rsae certs.
Solution:
Improve the certificate signatures check by doing more detailed parsing of the certificate. In order to differentiate between these two signature algorithms, s2n would need to grab the public key encryption type as well has the hash algorithm used in the rsa_pss signature.
Requirements / Acceptance Criteria:
Differentiate between these two types of signature algorithms.
