def _bcrypt_verify(certificate_or_public_key, signature, data, hash_algorithm, rsa_pss_padding=False):
if hash_algorithm == '<STR_LIT>':<EOL><INDENT>digest = data<EOL><DEDENT>else:<EOL><INDENT>hash_constant = {<EOL>'<STR_LIT>': BcryptConst.BCRYPT_MD5_ALGORITHM,<EOL>'<STR_LIT>': BcryptConst.BCRYPT_SHA1_ALGORITHM,<EOL>'<STR_LIT>': BcryptConst.BCRYPT_SHA256_ALGORITHM,<EOL>'<STR_LIT>': BcryptConst.BCRYPT_SHA384_ALGORITHM,<EOL>'<STR_LIT>': BcryptConst.BCRYPT_SHA512_ALGORITHM<EOL>}[hash_algorithm]<EOL>digest = getattr(hashlib, hash_algorithm)(data).digest()<EOL><DEDENT>padding_info = null()<EOL>flags = <NUM_LIT:0><EOL>if certificate_or_public_key.algorithm == '<STR_LIT>':<EOL><INDENT>if rsa_pss_padding:<EOL><INDENT>flags = BcryptConst.BCRYPT_PAD_PSS<EOL>padding_info_struct_pointer = struct(bcrypt, '<STR_LIT>')<EOL>padding_info_struct = unwrap(padding_info_struct_pointer)<EOL>hash_buffer = buffer_from_unicode(hash_constant)<EOL>padding_info_struct.pszAlgId = cast(bcrypt, '<STR_LIT>', hash_buffer)<EOL>padding_info_struct.cbSalt = len(digest)<EOL><DEDENT>else:<EOL><INDENT>flags = BcryptConst.BCRYPT_PAD_PKCS1<EOL>padding_info_struct_pointer = struct(bcrypt, '<STR_LIT>')<EOL>padding_info_struct = unwrap(padding_info_struct_pointer)<EOL>if hash_algorithm == '<STR_LIT>':<EOL><INDENT>padding_info_struct.pszAlgId = null()<EOL><DEDENT>else:<EOL><INDENT>hash_buffer = buffer_from_unicode(hash_constant)<EOL>padding_info_struct.pszAlgId = cast(bcrypt, '<STR_LIT>', hash_buffer)<EOL><DEDENT><DEDENT>padding_info = cast(bcrypt, '<STR_LIT>', padding_info_struct_pointer)<EOL><DEDENT>else:<EOL><INDENT>try:<EOL><INDENT>signature = algos.DSASignature.load(signature).to_p1363()<EOL><DEDENT>except (ValueError, OverflowError, TypeError):<EOL><INDENT>raise SignatureError('<STR_LIT>')<EOL><DEDENT><DEDENT>res = bcrypt.BCryptVerifySignature(<EOL>certificate_or_public_key.key_handle,<EOL>padding_info,<EOL>digest,<EOL>len(digest),<EOL>signature,<EOL>len(signature),<EOL>flags<EOL>)<EOL>failure = res == BcryptConst.STATUS_INVALID_SIGNATURE<EOL>failure = failure or res == BcryptConst.STATUS_INVALID_PARAMETER<EOL>if failure:<EOL><INDENT>raise SignatureError('<STR_LIT>')<EOL><DEDENT>handle_error(res)<EOL>
Verifies an RSA, DSA or ECDSA signature via CNG

:param certificate_or_public_key:
    A Certificate or PublicKey instance to verify the signature with

:param signature:
    A byte string of the signature to verify

:param data:
    A byte string of the data the signature is for

:param hash_algorithm:
    A unicode string of "md5", "sha1", "sha256", "sha384", "sha512" or "raw"

:param rsa_pss_padding:
    If PSS padding should be used for RSA keys

:raises:
    oscrypto.errors.SignatureError - when the signature is determined to be invalid
    ValueError - when any of the parameters contain an invalid value
    TypeError - when any of the parameters are of the wrong type
    OSError - when an error is returned by the OS crypto library