CoseSign1.Certificates improperly pins the signing hash algorithm to SHA-256

Summary

CertificateCoseSigningKeyProvider hard-codes the hash algorithm to SHA-256:

public HashAlgorithmName HashAlgorithm { get; } = HashAlgorithmName.SHA256;

Source: CoseSign1.Certificates/CertificateCoseSigningKeyProvider.cs at line 16

Problem

The signing hash algorithm is improperly pinned in the certificate-backed COSE signing key provider. Consumers cannot select or derive an appropriate hash algorithm when their certificate, signing policy, or COSE algorithm requires something other than SHA-256. This can cause incompatible signatures or prevent supported algorithms from being used.

Expected behavior

The provider should not unconditionally pin the hash algorithm to SHA-256. The algorithm should be configurable or determined from the selected COSE/signature algorithm and validated against the certificate and key capabilities.

Suggested direction

• Allow callers to provide the hash algorithm, or derive it from the requested COSE algorithm.
• Validate that the selected hash algorithm is compatible with the certificate and signing key.
• Add tests covering algorithms other than SHA-256 and rejecting unsupported combinations.

Additional context

Repository: microsoft/CoseSignTool

Commit reviewed: 06ad9848429e845876db4550c9131e390e2a32bd

Start with CoseSign1.Certificates/CertificateCoseSigningKeyProvider.cs at the HashAlgorithm property, then trace how the provider is selected and how the requested COSE/signature algorithm reaches it. Add coverage for a non-SHA-256 algorithm and unsupported certificate/key combinations; done means the hash is configurable or derived appropriately and compatibility is validated.