From 5c0afe67a5e1f96fe2a5a89c3e7eea994fbd0c5f Mon Sep 17 00:00:00 2001
From: Yuval Adam <_@yuv.al>
Date: Wed, 17 Mar 2021 10:57:07 +0200
Subject: Support ct=2 double hash fix

---
 verify.py | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/verify.py b/verify.py
index 57dd466..db3c589 100644
--- a/verify.py
+++ b/verify.py
@@ -19,35 +19,36 @@ def verify(qr_code_bytes):
     b64, payload = qr_code_bytes.split(b"#", maxsplit=1)
     sig = base64.decodebytes(b64)
 
-    h = hashes.Hash(hashes.SHA256())
-    h.update(payload.decode().encode("utf8"))
-    digest = h.finalize()
-
-    with open(cert("RamzorQRPubKey.pem"), "rb") as f:
-        k = serialization.load_pem_public_key(f.read())
-        k.verify(
-            sig,
-            digest,
-            padding.PKCS1v15(),
-            hashes.SHA256(),
-        )
-
-    print("Valid signature!")
-
     data = json.loads(payload)
+    payload = payload.decode().encode("utf8")
     if data["ct"] == 1:
+        digest = payload
         for i in range(len(data["p"])):
             print(f"Details of person number {i+1}:")
             print(f"\tIsraeli ID Number {data['p'][i]['idl']}")
             print(f"\tID valid by {data['p'][i]['e']}")
         print(f"Cert Unique ID {data['id']}")
     elif data["ct"] == 2:
+        h = hashes.Hash(hashes.SHA256())
+        h.update(payload)
+        digest = h.finalize()
         print(f"Israeli ID Number {data['idl']}")
         print(f"ID valid by {data['e']}")
         print(f"Cert Unique ID {data['id']}")
     else:
         print("Unsupported certificate type")
 
+    with open(cert("RamzorQRPubKey.pem"), "rb") as f:
+        k = serialization.load_pem_public_key(f.read())
+        k.verify(
+            sig,
+            digest,
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+
+    print("Valid signature!")
+
 
 def read_qr_code(image_path):
     return pyzbar.decode(Image.open(image_path))[0].data
-- 
cgit v1.3.1