package main

import (
	"fmt"
	"crypto/x509"
	"crypto/sha256"
	"crypto/dsa"
	"math/big"
	"errors"
	"encoding/asn1"
)

type dsaSignature struct {
	R, S *big.Int
}

func checkWithTruncatedHash(cert *x509.Certificate) error {
	hash := sha256.Sum256(signed)
	pub := cert.PublicKey.(*dsa.PublicKey)

	reqLen := pub.Q.BitLen() / 8

	if reqLen > len(hash) {
		return fmt.Errorf("Digest algorithm is too short for given DSA parameters.")
	}
	digest := hash[:reqLen]

	dsaSig := new(dsaSignature)
	if rest, err := asn1.Unmarshal(signature, dsaSig); err != nil {
		return err
	} else if len(rest) != 0 {
		return errors.New("x509: trailing data after DSA signature")
	}
	if dsaSig.R.Sign() <= 0 || dsaSig.S.Sign() <= 0 {
		return errors.New("x509: DSA signature contained zero or negative values")
	}
	if !dsa.Verify(pub, digest, dsaSig.R, dsaSig.S) {
		return errors.New("x509: DSA verification failure")
	}
	return nil
}

func main() {
	cert, _ := x509.ParseCertificate(rawCert)

	fmt.Printf("Result of check with original crypto/x509: %v\n", cert.CheckSignature(algo, signed, signature))
	fmt.Printf("Result of check with truncated hash: %v\n", checkWithTruncatedHash(cert))
}

var algo = x509.DSAWithSHA256

var rawCert = []byte { ... }
var signature = []byte { ... }
var signed = []byte { ... }