{"record":{"id":"f6be5144de78927b","repo":"OpenNHP/opennhp","slug":"sig-algo-mismatch-got-d-want-d","errorCode":null,"errorMessage":"sig algo mismatch: got %d, want %d","messagePattern":"sig algo mismatch: got (.+?), want (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":452,"sourceCode":"}\n\nfunc (a *Attestation) verifyCSVCertInfo(csvCert []byte, sigUsage int, sigAlgo int, keyUsage int, keyId []byte) error {\n\tcsvKeyUsage := csvCert[0x08:0x0C]\n\tcsvKeyUsageInt := int(binary.LittleEndian.Uint32(csvKeyUsage))\n\tif csvKeyUsageInt != keyUsage {\n\t\treturn fmt.Errorf(\"key usage mismatch: got %d, want %d\", csvKeyUsageInt, sigUsage)\n\t}\n\n\tcsvSigUsage := csvCert[0x414:0x418]\n\tcsvSigUsageInt := int(binary.LittleEndian.Uint32(csvSigUsage))\n\tif csvSigUsageInt != sigUsage {\n\t\treturn fmt.Errorf(\"sig usage mismatch: got %d, want %d\", csvSigUsageInt, sigAlgo)\n\t}\n\n\tcsvSigAlgo := csvCert[0x418:0x41C]\n\tcsvSigAlgoInt := int(binary.LittleEndian.Uint32(csvSigAlgo))\n\tif csvSigAlgoInt != sigAlgo {\n\t\treturn fmt.Errorf(\"sig algo mismatch: got %d, want %d\", csvSigAlgoInt, sigAlgo)\n\t}\n\n\tcsvCertifyingId := csvCert[0x1a4:0x1b4]\n\tif !bytes.Equal(csvCertifyingId, keyId) {\n\t\treturn fmt.Errorf(\"certifying id mismatch: got %x, want %x\", csvCertifyingId, keyId)\n\t}\n\n\treturn nil\n}\n\nfunc (a *Attestation) Verify() error {\n\tif err := a.verifyCertChain(a.GetSerialNumber()); err != nil {\n\t\treturn err\n\t}\n\n\tpek := a.evidence.CertificateChain.Pek\n\tattestationReport := a.evidence.AttestationReport\n\tattestationReportDataLen := unsafe.Sizeof(attestationReport)","sourceCodeStart":434,"sourceCodeEnd":470,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L434-L470","documentation":"During CSV (China Secure Virtualization / SM-protected) attestation certificate-chain verification, the signature algorithm identifier stored in the certificate blob at bytes 0x418-0x41B (little-endian uint32) does not match the algorithm expected by the caller. It fires in verifyCSVCertInfo, invoked from verifyCertChain, when the parsed cert was signed with a different algorithm (e.g. SM2 vs RSA/ECDSA) than the one the verifier is configured to accept, typically because the platform or firmware provisioned certs with a different signing algorithm or the evidence comes from a mismatched vendor implementation.","triggerScenarios":"Thrown at nhp/core/verifier/csv/csv.go:452 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the signature algorithm reported by the platform (e.g. via CSV vendor attestation tools) and align the expected sigAlgo parameter passed into verifyCSVCertInfo","Re-provision or re-export the CSV certificate chain so all certs are signed with the expected algorithm (typically SM2 for CSV platforms)","If the cert is legitimately signed with a supported but different algorithm, extend the verifier to accept it and verify the signature with the corresponding crypto implementation","Check for firmware or BIOS updates on the host that may have changed certificate provisioning defaults"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}