Command Line Validation of Indirect Signatures

[elantiguamsft]

The command line verb validate does not currently support the validation of "COSE detached signatures" - a COSE signing format that I will refer from this point on as "indirect signing".

Indirect signatures, as it exists presently, constitutes an embedded COSE signature where the embedded content represents the hash of the payload. The hashing algorithm is also encoded in the message.

For indirect signatures, validation requires that the payload be hashed using the same algorithm used in the creation of the COSE message. The computed hash is then compared to the hash stored in the content header to ensure the payload has not been mutated. This pull request updates the CoseSignTool.exe validate verb to check if the signature is indirect, in which case the aforementioned extra hash validation steps are taken.

Currently, indirect signatures embed the hash of the payload in the content header of the COSE message, and the hash algorithm is appended to the content type. The industry standard is likely to use a similar format where both the payload hash and algorithm name are stored in the content header encoded as a cbor object. Subsequent updates will be made to respect Microsoft internal practices and industry standards as they mature.