{"record":{"id":"e13fabcdf31801e6","repo":"OpenNHP/opennhp","slug":"sig-usage-mismatch-got-d-want-d","errorCode":null,"errorMessage":"sig usage mismatch: got %d, want %d","messagePattern":"sig usage mismatch: got (.+?), want (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":446,"sourceCode":"\thygonCertifyingId := hrk[0x14:0x24]\n\tif !bytes.Equal(hygonCertifyingId, keyId) {\n\t\treturn fmt.Errorf(\"certifying id mismatch: got %x, want %x\", hygonCertifyingId, keyId)\n\t}\n\n\treturn nil\n}\n\nfunc (a *Attestation) verifyCSVCertInfo(csvCert []byte, sigUsage int, sigAlgo int, keyUsage int, keyId []byte) error {\n\tcsvKeyUsage := csvCert[0x08:0x0C]\n\tcsvKeyUsageInt := int(binary.LittleEndian.Uint32(csvKeyUsage))\n\tif csvKeyUsageInt != keyUsage {\n\t\treturn fmt.Errorf(\"key usage mismatch: got %d, want %d\", csvKeyUsageInt, sigUsage)\n\t}\n\n\tcsvSigUsage := csvCert[0x414:0x418]\n\tcsvSigUsageInt := int(binary.LittleEndian.Uint32(csvSigUsage))\n\tif csvSigUsageInt != sigUsage {\n\t\treturn fmt.Errorf(\"sig usage mismatch: got %d, want %d\", csvSigUsageInt, sigAlgo)\n\t}\n\n\tcsvSigAlgo := csvCert[0x418:0x41C]\n\tcsvSigAlgoInt := int(binary.LittleEndian.Uint32(csvSigAlgo))\n\tif csvSigAlgoInt != sigAlgo {\n\t\treturn fmt.Errorf(\"sig algo mismatch: got %d, want %d\", csvSigAlgoInt, sigAlgo)\n\t}\n\n\tcsvCertifyingId := csvCert[0x1a4:0x1b4]\n\tif !bytes.Equal(csvCertifyingId, keyId) {\n\t\treturn fmt.Errorf(\"certifying id mismatch: got %x, want %x\", csvCertifyingId, keyId)\n\t}\n\n\treturn nil\n}\n\nfunc (a *Attestation) Verify() error {\n\tif err := a.verifyCertChain(a.GetSerialNumber()); err != nil {","sourceCodeStart":428,"sourceCodeEnd":464,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L428-L464","documentation":"Raised in verifyCSVCertInfo while parsing a CSV certificate blob: the signature-usage field at offset 0x414 does not equal the expected sigUsage. The certificate was issued for a different usage context than the one requested, so the signature verification path refuses it. (Note the format arguments are swapped in the code — the printed 'want' value is actually sigAlgo.)","triggerScenarios":"Thrown at nhp/core/verifier/csv/csv.go:446 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the CSV certificate was issued for the intended usage (e.g. attestation signing vs chip identity)","Re-collect fresh attestation evidence from the platform","Align the verifier's expected sigUsage constants with the CSV spec/firmware version"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}