Skip to content

Commit

Permalink
Use hash algo per ecdsa curve and add nistp384
Browse files Browse the repository at this point in the history
This commit adds support for verifying ecdsa signature on the
nistp384 curve with sha384 digests to the internal ecdsa_keys
module.

It does so by adding module global helper dictionary to map schemes
to hash algorithms.

Note: This commit tries to blend in with the current sslib design.
In future work we should:
- define securesystemslib-wide constants instead of hardcoding
  strings over and over again (see item 3 in #183)
  • Loading branch information
lukpueh committed Apr 6, 2020
1 parent 761aded commit 3e8a3d9
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion securesystemslib/ecdsa_keys.py
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@
from cryptography.hazmat.primitives.serialization import load_pem_private_key

import cryptography.exceptions

_SCHEME_HASHER = {
'ecdsa-sha2-nistp256': ec.ECDSA(hashes.SHA256()),
'ecdsa-sha2-nistp384': ec.ECDSA(hashes.SHA384())
}

except ImportError:
CRYPTO = False

Expand Down Expand Up @@ -331,7 +337,7 @@ def verify_signature(public_key, scheme, signature, data):
# verify() raises an 'InvalidSignature' exception if 'signature'
# is invalid.
try:
ecdsa_key.verify(signature, data, ec.ECDSA(hashes.SHA256()))
ecdsa_key.verify(signature, data, _SCHEME_HASHER[scheme])
return True

except (TypeError, cryptography.exceptions.InvalidSignature):
Expand Down

0 comments on commit 3e8a3d9

Please sign in to comment.