Add support for MD2, MD4, and MD5 to SignatureAlgorithm.

net/cert/internal/verify_signed_data.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_signed_data.h"
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/numerics/safe_math.h"
 #include "crypto/openssl_util.h"
@@ skipping 22 matching lines @@
 DEFINE_CERT_ERROR_ID(kUnacceptableEcdsaCurve,
                      "Unacceptable curve for ECDSA key");
 DEFINE_CERT_ERROR_ID(kSignatureVerificationFailed,
                      "Signature verification failed");
 
 // Converts a DigestAlgorithm to an equivalent EVP_MD*.
 WARN_UNUSED_RESULT bool GetDigest(DigestAlgorithm digest, const EVP_MD** out) {
   *out = nullptr;
 
   switch (digest) {
+    case DigestAlgorithm::Md2:
+    case DigestAlgorithm::Md4:
+    case DigestAlgorithm::Md5:
+      // Unsupported.
+      break;
     case DigestAlgorithm::Sha1:
       *out = EVP_sha1();
       break;
     case DigestAlgorithm::Sha256:
       *out = EVP_sha256();
       break;
     case DigestAlgorithm::Sha384:
       *out = EVP_sha384();
       break;
     case DigestAlgorithm::Sha512:
@@ skipping 232 matching lines @@
 
 }  // namespace
 
 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm,
                       const der::Input& signed_data,
                       const der::BitString& signature_value,
                       const der::Input& public_key_spki,
                       const SignaturePolicy* policy,
                       CertErrors* errors) {
   if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm, errors)) {
+    // TODO(crbug.com/634443): Include the DER for the AlgorithmIdentifier
     errors->AddError(kUnacceptableSignatureAlgorithm);
     return false;
   }
 
   bssl::UniquePtr<EVP_PKEY> public_key;
 
   // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm.
   switch (signature_algorithm.algorithm()) {
     case SignatureAlgorithmId::RsaPkcs1:
     case SignatureAlgorithmId::RsaPss:
       if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy, errors))
         return false;
       break;
     case SignatureAlgorithmId::Ecdsa:
       if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy, errors))
         return false;
       break;
   }
 
   if (!DoVerify(signature_algorithm, signed_data, signature_value,
                 public_key.get())) {
     errors->AddError(kSignatureVerificationFailed);
     return false;
   }
 
   return true;
 }
 
 }  // namespace net