OpenNHP/opennhp · error

sig usage mismatch: got

Error message

sig usage mismatch: got %d, want %d

What it means

Raised in verifyCSVCertInfo while parsing a CSV certificate blob: the signature-usage field at offset 0x414 does not equal the expected sigUsage. The certificate was issued for a different usage context than the one requested, so the signature verification path refuses it. (Note the format arguments are swapped in the code — the printed 'want' value is actually sigAlgo.)

Solutions

1. Verify the CSV certificate was issued for the intended usage (e.g. attestation signing vs chip identity)
2. Re-collect fresh attestation evidence from the platform
3. Align the verifier's expected sigUsage constants with the CSV spec/firmware version

When it happens

Trigger: Thrown at nhp/core/verifier/csv/csv.go:446 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/e13fabcdf31801e6. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/csv/csv.go:446

	hygonCertifyingId := hrk[0x14:0x24]
	if !bytes.Equal(hygonCertifyingId, keyId) {
		return fmt.Errorf("certifying id mismatch: got %x, want %x", hygonCertifyingId, keyId)
	}

	return nil
}

func (a *Attestation) verifyCSVCertInfo(csvCert []byte, sigUsage int, sigAlgo int, keyUsage int, keyId []byte) error {
	csvKeyUsage := csvCert[0x08:0x0C]
	csvKeyUsageInt := int(binary.LittleEndian.Uint32(csvKeyUsage))
	if csvKeyUsageInt != keyUsage {
		return fmt.Errorf("key usage mismatch: got %d, want %d", csvKeyUsageInt, sigUsage)
	}

	csvSigUsage := csvCert[0x414:0x418]
	csvSigUsageInt := int(binary.LittleEndian.Uint32(csvSigUsage))
	if csvSigUsageInt != sigUsage {
		return fmt.Errorf("sig usage mismatch: got %d, want %d", csvSigUsageInt, sigAlgo)
	}

	csvSigAlgo := csvCert[0x418:0x41C]
	csvSigAlgoInt := int(binary.LittleEndian.Uint32(csvSigAlgo))
	if csvSigAlgoInt != sigAlgo {
		return fmt.Errorf("sig algo mismatch: got %d, want %d", csvSigAlgoInt, sigAlgo)
	}

	csvCertifyingId := csvCert[0x1a4:0x1b4]
	if !bytes.Equal(csvCertifyingId, keyId) {
		return fmt.Errorf("certifying id mismatch: got %x, want %x", csvCertifyingId, keyId)
	}

	return nil
}

func (a *Attestation) Verify() error {
	if err := a.verifyCertChain(a.GetSerialNumber()); err != nil {

View on GitHub (pinned to 6e04ca5ff0)