{"record":{"id":"9045694dbcff9f5b","repo":"OpenNHP/opennhp","slug":"certifying-id-mismatch-got-x-want-x","errorCode":null,"errorMessage":"certifying id mismatch: got %x, want %x","messagePattern":"certifying id mismatch: got %x, want %x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":430,"sourceCode":"}\n\nfunc (a *Attestation) verifyHygonCertInfo(hrk []byte, curveId, keyUsage int, keyId []byte) error {\n\thygonKeyUsage := hrk[0x24:0x28]\n\n\thygonKeyUsageInt := int(binary.LittleEndian.Uint32(hygonKeyUsage))\n\tif hygonKeyUsageInt != keyUsage {\n\t\treturn fmt.Errorf(\"key usage mismatch: got %d, want %d\", keyUsage, keyUsage)\n\t}\n\n\thygonCurveId := hrk[0x40:0x44]\n\thygonCurveIdInt := int(binary.LittleEndian.Uint32(hygonCurveId))\n\tif hygonCurveIdInt != curveId {\n\t\treturn fmt.Errorf(\"curve id mismatch: got %d, want %d\", curveId, curveId)\n\t}\n\n\thygonCertifyingId := hrk[0x14:0x24]\n\tif !bytes.Equal(hygonCertifyingId, keyId) {\n\t\treturn fmt.Errorf(\"certifying id mismatch: got %x, want %x\", hygonCertifyingId, keyId)\n\t}\n\n\treturn nil\n}\n\nfunc (a *Attestation) verifyCSVCertInfo(csvCert []byte, sigUsage int, sigAlgo int, keyUsage int, keyId []byte) error {\n\tcsvKeyUsage := csvCert[0x08:0x0C]\n\tcsvKeyUsageInt := int(binary.LittleEndian.Uint32(csvKeyUsage))\n\tif csvKeyUsageInt != keyUsage {\n\t\treturn fmt.Errorf(\"key usage mismatch: got %d, want %d\", csvKeyUsageInt, sigUsage)\n\t}\n\n\tcsvSigUsage := csvCert[0x414:0x418]\n\tcsvSigUsageInt := int(binary.LittleEndian.Uint32(csvSigUsage))\n\tif csvSigUsageInt != sigUsage {\n\t\treturn fmt.Errorf(\"sig usage mismatch: got %d, want %d\", csvSigUsageInt, sigAlgo)\n\t}\n","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L412-L448","documentation":"Raised in verifyHygonCertInfo while checking a Hygon CSV attestation certificate: the certifying-id bytes at offset 0x14-0x24 of the hrk block do not equal the expected keyId. A mismatch means the certification blob was produced under a different certifying identity (wrong vendor key, mismatched platform, or corrupted blob), so the cert chain is rejected.","triggerScenarios":"Thrown at nhp/core/verifier/csv/csv.go:430 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the attestation evidence comes from the platform/firmware generation expected by the verifier","Update the verifier's trusted keyId/certifying-id table for the Hygon firmware in use","Check evidence transport (base64/zlib) for corruption if platforms genuinely match"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}