Skip to content

Enable certificate signatures using ECDSA with the secp256k1 curve #405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mkmks wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −4
Open

Enable certificate signatures using ECDSA with the secp256k1 curve #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,6 @@ pki-types = { package = "rustls-pki-types", version = "1.4.1" }
ring = "0.17"
rustls-webpki = { version = "0.103", features = ["ring", "std"] }
time = { version = "0.3.6", default-features = false }
x509-parser = "0.18"
x509-parser = { version = "0.18", features = ["verify"] }
yasna = { version = "0.5.2", features = ["time", "std"] }
zeroize = { version = "1.2" }
10 changes: 9 additions & 1 deletion rcgen/src/key_pair.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,13 @@ impl KeyPair {
KeyPairKind::Rsa(rsakp, &signature::RSA_PSS_SHA256)
} else {
#[cfg(feature = "aws_lc_rs")]
if alg == &PKCS_ECDSA_P521_SHA512 {
if alg == &PKCS_ECDSA_P256K1_SHA256 {
KeyPairKind::Ec(ecdsa_from_pkcs8(
&signature::ECDSA_P256K1_SHA256_ASN1_SIGNING,
&serialized_der,
rng,
)?)
} else if alg == &PKCS_ECDSA_P521_SHA512 {
KeyPairKind::Ec(ecdsa_from_pkcs8(
&signature::ECDSA_P521_SHA512_ASN1_SIGNING,
&serialized_der,
Expand Down Expand Up @@ -784,6 +790,8 @@ mod test {
for alg in [
&PKCS_ED25519,
&PKCS_ECDSA_P256_SHA256,
#[cfg(feature = "aws_lc_rs")]
&PKCS_ECDSA_P256K1_SHA256,
&PKCS_ECDSA_P384_SHA384,
#[cfg(feature = "aws_lc_rs")]
&PKCS_ECDSA_P521_SHA512,
Expand Down
4 changes: 4 additions & 0 deletions rcgen/src/oid.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,10 @@ pub(crate) const COMMON_NAME: &[u64] = &[2, 5, 4, 3];

/// id-ecPublicKey in [RFC 5480](https://datatracker.ietf.org/doc/html/rfc5480#appendix-A)
pub(crate) const EC_PUBLIC_KEY: &[u64] = &[1, 2, 840, 10045, 2, 1];
/// secp256k1 in [SEC 2, Appendix A.2.1](https://www.secg.org/sec2-v2.pdf)
/// Currently this is only supported with the `aws_lc_rs` feature
#[cfg(feature = "aws_lc_rs")]
pub(crate) const EC_SECP_256_K1: &[u64] = &[1, 3, 132, 0, 10];
/// secp256r1 in [RFC 5480](https://datatracker.ietf.org/doc/html/rfc5480#appendix-A)
pub(crate) const EC_SECP_256_R1: &[u64] = &[1, 2, 840, 10045, 3, 1, 7];
/// secp384r1 in [RFC 5480](https://datatracker.ietf.org/doc/html/rfc5480#appendix-A)
Expand Down
20 changes: 18 additions & 2 deletions rcgen/src/sign_algo.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,9 @@ impl fmt::Debug for SignatureAlgorithm {
write!(f, "PKCS_ED25519")
} else {
#[cfg(feature = "aws_lc_rs")]
if self == &PKCS_ECDSA_P521_SHA512 {
if self == &PKCS_ECDSA_P256K1_SHA256 {
return write!(f, "PKCS_ECDSA_P256K1_SHA256");
} else if self == &PKCS_ECDSA_P521_SHA512 {
return write!(f, "PKCS_ECDSA_P521_SHA512");
}

Expand Down Expand Up @@ -97,6 +99,8 @@ impl SignatureAlgorithm {
&PKCS_RSA_SHA512,
//&PKCS_RSA_PSS_SHA256,
&PKCS_ECDSA_P256_SHA256,
#[cfg(feature = "aws_lc_rs")]
&PKCS_ECDSA_P256K1_SHA256,
&PKCS_ECDSA_P384_SHA384,
#[cfg(feature = "aws_lc_rs")]
&PKCS_ECDSA_P521_SHA512,
Expand Down Expand Up @@ -172,7 +176,19 @@ pub(crate) mod algo {
},
};

/// ECDSA signing using the P-256 curves and SHA-256 hashing as per [RFC 5758](https://tools.ietf.org/html/rfc5758#section-3.2)
/// ECDSA signing using the K-256 curves and SHA-256 hashing as per [SEC 2, Section 2.4.1](https://www.secg.org/sec2-v2.pdf)
/// Currently this is only supported with the `aws_lc_rs` feature
#[cfg(feature = "aws_lc_rs")]
pub static PKCS_ECDSA_P256K1_SHA256: SignatureAlgorithm = SignatureAlgorithm {
oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_256_K1],
#[cfg(feature = "crypto")]
sign_alg: SignAlgo::EcDsa(&signature::ECDSA_P256K1_SHA256_ASN1_SIGNING),
// ecdsa-with-SHA256 in RFC 5758
oid_components: &[1, 2, 840, 10045, 4, 3, 2],
params: SignatureAlgorithmParams::None,
};

/// ECDSA signing using the P-256 curves with verifiably random parameters and SHA-256 hashing as per [RFC 5758](https://tools.ietf.org/html/rfc5758#section-3.2)
pub static PKCS_ECDSA_P256_SHA256: SignatureAlgorithm = SignatureAlgorithm {
oids_sign_alg: &[EC_PUBLIC_KEY, EC_SECP_256_R1],
#[cfg(feature = "crypto")]
Expand Down