{"record":{"id":"2ce1b365890049d0","repo":"golang/go","slug":"invalid-signature","errorCode":null,"errorMessage":"invalid signature","messagePattern":"invalid signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/ecdsa/ecdsa_s390x.go","lineNumber":173,"sourceCode":"\t\t\t}\n\t\t\treturn &Signature{R: r, S: s}, nil\n\t\tcase 1: // error\n\t\t\treturn nil, errors.New(\"zero parameter\")\n\t\tcase 2: // retry\n\t\t\tcontinue\n\t\t}\n\t}\n}\n\nfunc verify[P Point[P]](c *Curve[P], pub *PublicKey, hash []byte, sig *Signature) error {\n\tfunctionCode, blockSize, ok := canUseKDSA(c.curve)\n\tif !ok {\n\t\treturn verifyGeneric(c, pub, hash, sig)\n\t}\n\n\tr, s := sig.R, sig.S\n\tif len(r) > blockSize || len(s) > blockSize {\n\t\treturn errors.New(\"invalid signature\")\n\t}\n\n\t// The parameter block looks like the following for verify:\n\t// \t+---------------------+\n\t// \t|   Signature(R)      |\n\t//\t+---------------------+\n\t//\t|   Signature(S)      |\n\t//\t+---------------------+\n\t//\t|   Hashed Message    |\n\t//\t+---------------------+\n\t//\t|   Public Key X      |\n\t//\t+---------------------+\n\t//\t|   Public Key Y      |\n\t//\t+---------------------+\n\t//\t|                     |\n\t//\t|        ...          |\n\t//\t|                     |\n\t//\t+---------------------+","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/ecdsa/ecdsa_s390x.go#L155-L191","documentation":"Returned by the s390x (IBM Z) hardware-accelerated ECDSA verify path when a signature's R or S component byte length exceeds the KDSA instruction's blockSize for the curve (32 for P-256, 48 for P-384, 80 for P-521). Since a canonical scalar mod n always fits in blockSize bytes, an oversized component cannot be a valid signature and is rejected before the KDSA call (which would otherwise panic in appendBlock).","triggerScenarios":"Calling ecdsa.Verify (or the internal verify) on s390x hardware where supportsKDSA is true, with a Signature whose R or S fields were assembled from malformed/un-trimmed big-endian byte slices longer than the curve's blockSize.","commonSituations":"Decoding an ASN.1 DER signature whose integers were not left-trimmed of zero padding into fixed-size buffers; copying a P-521 raw R/S (66 bytes) without zero-padding into an 80-byte block; interoperating with a peer that pads integers to the field size rather than the order size.","solutions":["Ensure R and S are decoded and stored as fixed-width big-endian byte slices whose length matches blockSize (right-aligned, zero-padded on the left).","If you control encoding, use the curve's signature-marshal helpers (e.g. SignASN1 / VerifyASN1) rather than constructing Signature{R,S} manually.","On non-s390x targets this path is unreachable; reproduce on real IBM Z hardware or under qemu-s390x to debug."],"exampleFix":"// before: r and s are raw *big.Int byte slices of arbitrary length\nsig := &ecdsa.Signature{R: rawR, S: rawS}\nreturn ecdsa.Verify(pub, hash, sig)\n\n// after: normalize to fixed-width big-endian of blockSize\nr := fixedWidth(rawR, blockSize)\ns := fixedWidth(rawS, blockSize)\n// where fixedWidth left-pads with zeros and errors if input exceeds blockSize","handlingStrategy":"validation","validationCode":"// Before calling ecdsa.Verify with a manually built Signature on s390x:\nbs := blockSizeForCurve(curve) // 32 / 48 / 80\nif len(sig.R) > bs || len(sig.S) > bs {\n    return fmt.Errorf(\"signature R/S exceeds curve block size %d\", bs)\n}\nreturn ecdsa.Verify(pub, hash, sig)","typeGuard":null,"tryCatchPattern":"// Go: check err from Verify; treat invalid-signature errors as auth failure.\nif err := ecdsa.Verify(pub, hash, sig); err != nil {\n    // err may be 'invalid signature' from oversized R/S or KDSA rejection\n    return fmt.Errorf(\"signature rejected: %w\", err)\n}","preventionTips":["Prefer SignASN1/VerifyASN1 to avoid manual R/S byte handling.","When assembling raw signatures, normalize R and S to fixed-width big-endian of the curve's blockSize.","On IBM Z, exercise both the KDSA and generic paths in tests to catch encoding bugs."],"tags":["crypto","ecdsa","s390x","fips140","signature"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T11:17:21.771Z"}