Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add nistp384 signature verification support #228

Merged
merged 3 commits into from
Apr 9, 2020
Merged

Add nistp384 signature verification support #228

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
761aded
Support nistp384 in ecdsa scheme and key formats
lukpueh Apr 6, 2020
3e8a3d9
Use hash algo per ecdsa curve and add nistp384
lukpueh Apr 6, 2020
efe9afe
Add ecdsa-sha2-nistp384 support to keys.verify_sig
lukpueh Apr 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion securesystemslib/ecdsa_keys.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@
from cryptography.hazmat.primitives.serialization import load_pem_private_key

import cryptography.exceptions

_SCHEME_HASHER = {
'ecdsa-sha2-nistp256': ec.ECDSA(hashes.SHA256()),
'ecdsa-sha2-nistp384': ec.ECDSA(hashes.SHA384())
}

except ImportError:
CRYPTO = False

Expand Down Expand Up @@ -331,7 +337,7 @@ def verify_signature(public_key, scheme, signature, data):
# verify() raises an 'InvalidSignature' exception if 'signature'
# is invalid.
try:
ecdsa_key.verify(signature, data, ec.ECDSA(hashes.SHA256()))
ecdsa_key.verify(signature, data, _SCHEME_HASHER[scheme])
return True

except (TypeError, cryptography.exceptions.InvalidSignature):
Expand Down
15 changes: 4 additions & 11 deletions securesystemslib/formats.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,9 +164,8 @@
# http://www.emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm#table1
RSAKEYBITS_SCHEMA = SCHEMA.Integer(lo=2048)

# The supported ECDSA signature schemes (ecdsa-sha2-nistp256 is supported by
# default).
ECDSA_SCHEME_SCHEMA = SCHEMA.OneOf([SCHEMA.String('ecdsa-sha2-nistp256')])
# The supported ECDSA signature schemes
ECDSA_SCHEME_SCHEMA = SCHEMA.RegularExpression(r'ecdsa-sha2-nistp(256|384)')

# A pyca-cryptography signature.
PYCACRYPTOSIGNATURE_SCHEMA = SCHEMA.AnyBytes()
Expand Down Expand Up @@ -201,7 +200,7 @@
# Supported securesystemslib key types.
KEYTYPE_SCHEMA = SCHEMA.OneOf(
[SCHEMA.String('rsa'), SCHEMA.String('ed25519'),
SCHEMA.String('ecdsa-sha2-nistp256')])
SCHEMA.RegularExpression(r'ecdsa-sha2-nistp(256|384)')])

# A generic securesystemslib key. All securesystemslib keys should be saved to
# metadata files in this format.
Expand Down Expand Up @@ -254,7 +253,7 @@
# An ECDSA securesystemslib key.
ECDSAKEY_SCHEMA = SCHEMA.Object(
object_name = 'ECDSAKEY_SCHEMA',
keytype = SCHEMA.String('ecdsa-sha2-nistp256'),
keytype = SCHEMA.RegularExpression(r'ecdsa-sha2-nistp(256|384)'),
scheme = ECDSA_SCHEME_SCHEMA,
keyid = KEYID_SCHEMA,
keyid_hash_algorithms = SCHEMA.Optional(HASHALGORITHMS_SCHEMA),
Expand All @@ -272,12 +271,6 @@
# An ECDSA signature.
ECDSASIGNATURE_SCHEMA = SCHEMA.AnyBytes()

# Required installation libraries expected by the repository tools and other
# cryptography modules.
REQUIRED_LIBRARIES_SCHEMA = SCHEMA.ListOf(SCHEMA.OneOf(
[SCHEMA.String('general'), SCHEMA.String('ed25519'), SCHEMA.String('rsa'),
SCHEMA.String('ecdsa-sha2-nistp256')]))

# Ed25519 signature schemes. The vanilla Ed25519 signature scheme is currently
# supported.
ED25519_SIG_SCHEMA = SCHEMA.OneOf([SCHEMA.String('ed25519')])
Expand Down
4 changes: 2 additions & 2 deletions securesystemslib/keys.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,8 +847,8 @@ def verify_signature(key_dict, signature, data):
raise securesystemslib.exceptions.UnsupportedAlgorithmError('Unsupported'
' signature scheme is specified: ' + repr(scheme))

elif keytype == 'ecdsa-sha2-nistp256':
if scheme == 'ecdsa-sha2-nistp256':
elif keytype in ['ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384']:
if scheme in ['ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384']:
valid_signature = securesystemslib.ecdsa_keys.verify_signature(public,
scheme, sig, data)

Expand Down