feat(29-03): wire real XMLDSig crypto into the [candidate] arm (D-01)

Closes the published-hex SAML auth-bypass: the [candidate] arm of
verified_signed_node now performs genuine cryptographic verification
between selecting the single candidate and building %SignedNode{}.

- Add :digest_mismatch + :unsupported_signature_algorithm to the
  xml_error_type union (xml.ex, D-08)
- Thread cert_chain from do_verify/4 through
  verify_algorithms_and_candidates/4 + verified_signed_node/5 to the arm
- public_key_from_cert_chain/1: fail-closed PEM->RSA pubkey via
  pem_decode + pkix_decode_cert(:otp) -> element(8) SPKI; try/rescue maps
  every malformed PEM/DER to :untrusted_certificate, never raises (D-04,
  Pitfall 3)
- Read D-02 keys (:signed_info_node/:signature_value_b64/
  :digest_value_b64/:node) off the RAW candidate map
- Step order (all fail CLOSED, typed errors): digest-atom + ECDSA gate
  (D-06/D-07) -> pubkey (D-04) -> sig math (C14N.serialize SignedInfo +
  safe_verify :public_key.verify, D-03) -> digest recompute
  (:crypto.hash over canonicalize, length-guard before
  :crypto.hash_equals, D-05)
- SignedInfo prefix_list read from its own InclusiveNamespaces (Open Q2),
  not a hardcoded default
- Triage the one structure-only {:ok} binding test: a single
  crypto-input-less candidate now fails closed (:missing_signature);
  genuine positive lives in signature_crypto_test.exs

mix test signature_crypto_test.exs signed_node_binding_test.exs
--warnings-as-errors: 19/0; broader test/relyra/security test/security:
161/0; C14N golden lane: 102/0; compile --warnings-as-errors clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: szTheory

lib/relyra/security/signature.ex

@@ -4,6 +4,8 @@ defmodule Relyra.Security.Signature do
   alias Relyra.Error
   alias Relyra.Security.AlgorithmPolicy
   alias Relyra.Security.SignedNode
+  alias Relyra.Security.XML.C14N
+  alias Relyra.Security.XML.PureBeam
 
   @spec verify(map(), map(), [binary()], keyword()) :: {:ok, SignedNode.t()} | {:error, Error.t()}
   def verify(parsed_doc, connection, cert_chain, opts \\ [])
@@ -130,11 +132,11 @@ defmodule Relyra.Security.Signature do
          )}
 
       true ->
-        verify_algorithms_and_candidates(parsed_doc, details, opts)
+        verify_algorithms_and_candidates(parsed_doc, details, cert_chain, opts)
     end
   end
 
-  defp verify_algorithms_and_candidates(parsed_doc, details, opts) do
+  defp verify_algorithms_and_candidates(parsed_doc, details, cert_chain, opts) do
     policy = Keyword.get(opts, :algorithm_policy, AlgorithmPolicy.default())
     signature_method = Map.get(parsed_doc, :signature_method)
     digest_method = Map.get(parsed_doc, :digest_method)
@@ -146,7 +148,7 @@ defmodule Relyra.Security.Signature do
            ),
          :ok <-
            evaluate_policy(AlgorithmPolicy.enforce_digest_method(policy, digest_method), details) do
-      verified_signed_node(parsed_doc, signature_method, digest_method, details)
+      verified_signed_node(parsed_doc, signature_method, digest_method, cert_chain, details)
     end
   end
 
@@ -156,7 +158,7 @@ defmodule Relyra.Security.Signature do
     {:error, merge_error_details(error, details)}
   end
 
-  defp verified_signed_node(parsed_doc, signature_method, digest_method, details) do
+  defp verified_signed_node(parsed_doc, signature_method, digest_method, cert_chain, details) do
     signed_candidates = Map.get(parsed_doc, :signed_candidates, [])
 
     case signed_candidates do
@@ -165,14 +167,24 @@ defmodule Relyra.Security.Signature do
          Error.new(:missing_signature, "No signed node candidates were verified", details)}
 
       [candidate] ->
-        {:ok,
-         %SignedNode{
-           xml_id: Map.get(candidate, :xml_id),
-           xpath: Map.get(candidate, :xpath),
-           signed_xml: Map.get(candidate, :signed_xml, ""),
-           signature_method: signature_method,
-           digest_method: digest_method
-         }}
+        # D-01: THE published-hex auth-bypass site. The crypto runs BETWEEN
+        # matching the single [candidate] and building %SignedNode{}. All
+        # pre-existing trust gates already ran in do_verify/4 (cert_chain present,
+        # KeyInfo-trust rejection, duplicate-ID, algorithm allowlist) and the
+        # single-candidate selection happened above — none of that is touched.
+        # `candidate` is the RAW enriched map off parsed_doc[:signed_candidates]
+        # (Plan 02 D-02), NOT a select_candidate handle.
+        with :ok <-
+               cryptographically_verify(candidate, signature_method, cert_chain, details) do
+          {:ok,
+           %SignedNode{
+             xml_id: Map.get(candidate, :xml_id),
+             xpath: Map.get(candidate, :xpath),
+             signed_xml: Map.get(candidate, :signed_xml, ""),
+             signature_method: signature_method,
+             digest_method: digest_method
+           }}
+        end
 
       candidates ->
         {:error,
@@ -184,6 +196,204 @@ defmodule Relyra.Security.Signature do
     end
   end
 
+  # Real cryptographic XMLDSig verification of the bound candidate (D-01..D-08).
+  # Every step fails CLOSED to a typed %Relyra.Error{} naming the failed check;
+  # NOTHING here may raise (Pitfalls 3, 4). Step order matters: the digest-atom
+  # / ECDSA gate (D-06/D-07) runs BEFORE any verify attempt, then key extraction
+  # (D-04), then the SignedInfo signature math (D-03), then the Reference digest
+  # recompute (D-05). %SignedNode{} is only built when BOTH crypto checks pass.
+  defp cryptographically_verify(candidate, signature_method, cert_chain, details) do
+    signed_info_node = Map.get(candidate, :signed_info_node)
+    signature_value_b64 = Map.get(candidate, :signature_value_b64)
+    digest_value_b64 = Map.get(candidate, :digest_value_b64)
+    referenced_node = Map.get(candidate, :node)
+
+    with :ok <- require_field(signed_info_node, :missing_signature, "SignedInfo", details),
+         :ok <-
+           require_field(signature_value_b64, :invalid_signature, "SignatureValue", details),
+         :ok <- require_field(digest_value_b64, :digest_mismatch, "DigestValue", details),
+         :ok <- require_field(referenced_node, :missing_signature, "referenced node", details),
+         # 1. Digest-atom + ECDSA gate (D-06/D-07) — fail CLOSED before any verify.
+         {:ok, digest_atom} <- digest_atom(signature_method, details),
+         # 2. Trust-source public key (D-04) — configured cert_chain only.
+         {:ok, public_key} <- public_key_from_cert_chain(cert_chain, details),
+         # 3. Signature math (D-03) — :public_key.verify of the canonical SignedInfo.
+         :ok <-
+           verify_signature_math(
+             signed_info_node,
+             signature_value_b64,
+             digest_atom,
+             public_key,
+             details
+           ),
+         # 4. Digest check (D-05) — recompute over the canonical referenced element.
+         :ok <- verify_reference_digest(candidate, digest_value_b64, digest_atom, details) do
+      :ok
+    end
+  end
+
+  defp require_field(value, _error_type, _label, _details) when not is_nil(value), do: :ok
+
+  defp require_field(_value, error_type, label, details) do
+    {:error,
+     Error.new(
+       error_type,
+       "Signed candidate is missing required #{label}",
+       Map.put(details, :reason, :missing_signature_input)
+     )}
+  end
+
+  # D-06/D-07: map the signature-method URI to the digest atom, failing CLOSED
+  # for ECDSA / unknown (the typed reject is the contract — the allowlist still
+  # permits ECDSA URIs, Plan 02 decision).
+  defp digest_atom(signature_method, details) do
+    case AlgorithmPolicy.digest_atom_for_signature_method(signature_method) do
+      {:ok, atom} ->
+        {:ok, atom}
+
+      {:error, :unsupported_signature_algorithm} ->
+        {:error,
+         Error.new(
+           :unsupported_signature_algorithm,
+           "Signature algorithm is not supported for cryptographic verification",
+           Map.put(details, :signature_method, signature_method)
+         )}
+    end
+  end
+
+  # D-04: extract the RSA public key from the FIRST (leaf) configured cert PEM.
+  # Mirrors the certificate_facts.ex:26-47 pem_decode + try/rescue idiom and
+  # fails CLOSED with :untrusted_certificate on ANY malformed PEM/DER (Pitfall 3
+  # — pem_entry_decode / pkix_decode_cert RAISE on malformed input). Per A1 the
+  # configured signing cert is the single/first entry; chain-walk is out of scope.
+  defp public_key_from_cert_chain(cert_chain, details) do
+    case public_key_from_cert_chain(cert_chain) do
+      {:ok, public_key} ->
+        {:ok, public_key}
+
+      {:error, :untrusted_certificate} ->
+        {:error,
+         Error.new(
+           :untrusted_certificate,
+           "Configured certificate public key could not be extracted",
+           Map.put(details, :reason, :public_key_extraction_failed)
+         )}
+    end
+  end
+
+  @doc false
+  # Bare PEM→public-key extraction (no %Relyra.Error{} wrapping). Returns
+  # {:ok, public_key} | {:error, :untrusted_certificate}. NEVER raises.
+  def public_key_from_cert_chain([pem | _rest]) when is_binary(pem) do
+    with [entry | _] <- :public_key.pem_decode(pem),
+         der when is_binary(der) <- elem(entry, 1) do
+      {:OTPCertificate, otp_tbs, _sig_alg, _sig} = :public_key.pkix_decode_cert(der, :otp)
+      {:OTPSubjectPublicKeyInfo, _alg_id, public_key} = :erlang.element(8, otp_tbs)
+      {:ok, public_key}
+    else
+      _ -> {:error, :untrusted_certificate}
+    end
+  rescue
+    _ -> {:error, :untrusted_certificate}
+  end
+
+  def public_key_from_cert_chain(_cert_chain), do: {:error, :untrusted_certificate}
+
+  # D-03: canonicalize the SignedInfo (bare exclusive-C14N — SignedInfo carries
+  # NO enveloped-signature transform; reading its own ds:CanonicalizationMethod
+  # InclusiveNamespaces PrefixList when present, empty list otherwise) and verify
+  # the decoded SignatureValue with :public_key.verify against the configured key.
+  defp verify_signature_math(
+         signed_info_node,
+         signature_value_b64,
+         digest_atom,
+         public_key,
+         details
+       ) do
+    prefix_list = signed_info_prefix_list(signed_info_node)
+
+    with {:ok, c14n_signed_info} <- C14N.serialize(signed_info_node, prefix_list: prefix_list),
+         {:ok, sig_bytes} <- decode_b64(signature_value_b64) do
+      if safe_verify(c14n_signed_info, digest_atom, sig_bytes, public_key) do
+        :ok
+      else
+        {:error,
+         Error.new(
+           :invalid_signature,
+           "SignatureValue failed cryptographic verification",
+           details
+         )}
+      end
+    else
+      :error ->
+        {:error,
+         Error.new(
+           :invalid_signature,
+           "SignatureValue is not valid base64",
+           details
+         )}
+
+      {:error, %Error{} = error} ->
+        {:error, merge_error_details(error, details)}
+    end
+  end
+
+  # D-05: recompute the Reference digest over the canonicalized, transformed
+  # referenced element (PureBeam.canonicalize over the bound :node — the EXACT
+  # node the verifier consumes, anti-XSW) and constant-time-compare it to the
+  # declared DigestValue. Length-guard BEFORE :crypto.hash_equals/2 (Pitfall 4 —
+  # it RAISES on unequal-length inputs).
+  defp verify_reference_digest(candidate, digest_value_b64, digest_atom, details) do
+    with {:ok, %{canonical_xml: ref_bytes}} <- PureBeam.canonicalize(candidate),
+         {:ok, declared} <- decode_b64(digest_value_b64) do
+      recomputed = :crypto.hash(digest_atom, ref_bytes)
+
+      if byte_size(recomputed) == byte_size(declared) and
+           :crypto.hash_equals(recomputed, declared) do
+        :ok
+      else
+        {:error,
+         Error.new(
+           :digest_mismatch,
+           "Recomputed Reference digest does not match DigestValue",
+           details
+         )}
+      end
+    else
+      :error ->
+        {:error,
+         Error.new(
+           :digest_mismatch,
+           "DigestValue is not valid base64",
+           details
+         )}
+
+      {:error, %Error{} = error} ->
+        {:error, merge_error_details(error, details)}
+    end
+  end
+
+  # Read the SignedInfo's own ds:CanonicalizationMethod InclusiveNamespaces
+  # PrefixList when present (reusing the C14N.prefix_list_from_transforms/1 shape,
+  # which scans a node for an InclusiveNamespaces descendant). Empty list is the
+  # DERIVED result for the local signer (Open Q2), NOT a hardcoded default.
+  defp signed_info_prefix_list(signed_info_node) do
+    C14N.prefix_list_from_transforms(signed_info_node)
+  end
+
+  defp decode_b64(value) when is_binary(value), do: Base.decode64(value)
+  defp decode_b64(_value), do: :error
+
+  # :public_key.verify/4 returns false on a bad signature (no raise) but RAISES
+  # on a malformed KEY / decoded ASN.1 (Pitfall 3). Wrap it so a malformed key
+  # surfaces as a non-verifying result (the caller emits :invalid_signature),
+  # never an escaping exception on the auth path.
+  defp safe_verify(message, digest_atom, signature, public_key) do
+    :public_key.verify(message, digest_atom, signature, public_key)
+  rescue
+    _ -> false
+  end
+
   defp merge_error_details(%Error{details: error_details} = error, details)
        when is_map(error_details) do
     %{error | details: Map.merge(details, error_details)}

lib/relyra/security/xml.ex

@@ -19,6 +19,8 @@ defmodule Relyra.Security.XML do
           | :canonicalization_failed
           | :untrusted_certificate
           | :unsigned_or_partial_signature
+          | :digest_mismatch
+          | :unsupported_signature_algorithm
 
   @callback parse_safely(binary(), keyword()) ::
               {:ok, term()} | {:error, %Error{}}

test/security/signed_node_binding_test.exs

@@ -60,15 +60,21 @@ defmodule Relyra.Security.SignedNodeBindingTest do
     assert details.connection_id == "conn-1"
   end
 
-  test "verify/4 returns the exact verified signed node when candidate count is one" do
-    assert {:ok, %Relyra.Security.SignedNode{} = signed_node} =
+  # Phase 29 Plan 03 triage (Rule 1/3): once real crypto is wired into the
+  # [candidate] arm (D-01), a SINGLE structure-only candidate that selects past
+  # all trust gates can no longer return {:ok} — it carries no SignedInfo /
+  # SignatureValue / DigestValue, so the crypto fails CLOSED. This is the
+  # bypass being closed: the selection path reaches exactly one candidate, then
+  # rejects it for lacking signature material instead of trusting structure
+  # alone. The genuine {:ok, %SignedNode{}} positive lives in
+  # test/relyra/security/signature_crypto_test.exs (the in-test genuine signer);
+  # the fuller end-to-end pipeline triage is Plan 04.
+  test "verify/4 fails closed on a single structure-only candidate (no crypto inputs)" do
+    assert {:error, %Error{type: :missing_signature, details: details}} =
              Signature.verify(base_parsed_doc(), connection(), cert_chain())
 
-    assert signed_node.xml_id == "assertion-1"
-    assert signed_node.xpath == "/Response/Assertion[1]"
-    assert signed_node.signed_xml == "<Assertion>signed</Assertion>"
-    assert signed_node.signature_method == @allowed_signature_method
-    assert signed_node.digest_method == @allowed_digest_method
+    assert details.reason == :missing_signature_input
+    assert details.connection_id == "conn-1"
   end
 
   defp base_parsed_doc(overrides \\ %{}) do