Implement NIST P521 signature verification #1631

vkrasnov · 2023-09-01T13:57:44Z

Need a way to work on the 32bit part, as 521 is kinda awkward in this regard, because number of limbs in 32 bit mode is not double that of 521 mode.

briansmith · 2023-10-03T15:57:42Z

Vlad, my understanding is that you have it working for 64-bit but not 32-bit targets. is that right? Happy to have a chat with you about how to resolve the 32-bit issues.

vkrasnov · 2023-10-03T17:54:15Z

Yes, this is correct

codecov · 2023-10-06T18:53:09Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (ee5db43) 96.01% compared to head (561a613) 96.26%.

❗ Current head 561a613 differs from pull request most recent head 932beef. Consider uploading reports for the commit 932beef to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1631      +/-   ##
==========================================
+ Coverage   96.01%   96.26%   +0.24%     
==========================================
  Files         136      137       +1     
  Lines       20774    20764      -10     
  Branches      226      228       +2     
==========================================
+ Hits        19946    19988      +42     
+ Misses        793      742      -51     
+ Partials       35       34       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

briansmith · 2023-10-09T04:21:41Z

Vlad, I just created a new branch b/generate-curve that contains the test case generator I used for P-256 and P-384 many years ago. This will help you generate the analogous tests for P-521.

I am still looking for the program I used to generate the tops of ops/p{256,384}.rs. I will share it with you when I find it.

briansmith · 2023-10-09T05:08:03Z

I am still looking for the program I used to generate the tops of ops/p{256,384}.rs. I will share it with you when I find it.

It seems like I do have that program, but it isn't going to help us. I will review your PR #1702 and come back to this one.

vkrasnov · 2023-10-09T12:43:13Z

I copied the ec tests from boringssl, the ops tests could perhaps help understand why 32bit code fails, but my understanding that they are provided in montromery representation, which is different between 64 and 32 bits

briansmith · 2023-10-18T00:57:37Z

I copied the ec tests from boringssl, the ops tests could perhaps help understand why 32bit code fails, but my understanding that they are provided in montromery representation, which is different between 64 and 32 bits

I will generate the ops tests for P-521 so that they work for 32-bit and 64-bit targets and share them in a PR. This should let us identify the failure for 32-bit targets. I think we need to also do merge 1758 and rebase this on top of that, as I'm not confortable with the type punning we're doing, especially when BoringSSL is no longer doing it.

src/ec/suite_b/ops.rs

src/ec/suite_b/ecdsa/digest_scalar.rs

src/ec/suite_b/ops/p521.rs

crypto/fipsmodule/ec/ecp_nistz.inl

briansmith

Some more suggestions.

crypto/fipsmodule/ec/ecp_nistz.inl

crypto/fipsmodule/ec/gfp_p384.c

briansmith · 2023-10-25T17:33:41Z

Regarding the missing tests: I am working on changing the point arithmetic tests so that the test data files are NOT Montgomery-encoded. See PR #1769 and PR #1770.

Regarding generating tests for p521_elem_*, it looks like the Montgomery encoding issue only affects the multiplication tests. I guess I will do something similar to what I am doing in #1770 for those.

briansmith · 2023-10-25T21:04:53Z

Now that PR #1756 is merged, you can run python3 mk/generate_curves.py which will generate target/curves/p{256,384,521}.rs. When you update this PR, could you merge in the changes from what's generated into target/curves (using two-way merge) and/or change mk/generate_curves.py as needed? This will make it easier to review this as well. Simiarly, if you have code that generates gfp_521.c, it would be awesome to have that added to mk/generate_curves.py.

yacinehmito · 2023-11-21T22:12:31Z

@briansmith @vkrasnov Is there a way I can help getting this merged? (I really need this; see denoland/deno#21169).

I can take action on the review, but I am wary of doing this without asking first.

tgross35 · 2023-11-30T10:00:33Z

If it helps for reference, rustcrypto also very recently imlemented signing for P521 RustCrypto/elliptic-curves#953 RustCrypto/elliptic-curves#956

vkrasnov · 2024-01-05T17:51:44Z

Converting to draft until #1881 and #1883 are merged

briansmith · 2024-01-11T21:00:50Z

The clippy failure is due to the newest Rust toolchain having a stricter clippy. If you rebase on top of main then you will get the fix, which was in #1888.

This change makes it easier to reuse the P384 code which is quite generic already. No algorithmic changes are made, only some code is shuffled around. This prepares the ground for P521 implementation.

This code almost entirely reuses the P384 code, and only implements the dedicated inversion routines on top of the code generated by generate_curves.py

yacinehmito · 2024-03-16T21:27:57Z

How can I help move this forward?

rami3l · 2024-12-07T12:05:52Z

This could be interesting for the Rustup project as well.

We've switched from ring to aws-lc-rs for our rustls backend mostly for P521 support (rust-lang/rustup#3806), but the latter's building pipeline is longer and is prone to platform-specific cmake errors...

It would definitely be nice if we had more options to choose from, such as ring.

vkrasnov force-pushed the vlad/p521_verify branch 2 times, most recently from bfea65d to 4608342 Compare September 1, 2023 14:12

tgross35 mentioned this pull request Oct 3, 2023

NIST curve P-521 SHA-512 support for generating keys and signing #824

Open

vkrasnov force-pushed the vlad/p521_verify branch 8 times, most recently from 8440c57 to 4e94c35 Compare October 6, 2023 17:48

vkrasnov force-pushed the vlad/p521_verify branch from 4e94c35 to 5664a87 Compare October 6, 2023 19:38

briansmith mentioned this pull request Oct 15, 2023

Support for ecdsaWithSHA512 signature algorithm rustls/rustls#1367

Closed

deepu105 mentioned this pull request Oct 20, 2023

Add ES512 support Keats/jsonwebtoken#250

Open

briansmith reviewed Oct 24, 2023

View reviewed changes

src/ec/suite_b/ops.rs Show resolved Hide resolved

vkrasnov force-pushed the vlad/p521_verify branch 2 times, most recently from 4a38b14 to 6b2b571 Compare October 24, 2023 15:46

briansmith requested changes Oct 25, 2023

View reviewed changes

crypto/fipsmodule/ec/ecp_nistz.inl Show resolved Hide resolved

crypto/fipsmodule/ec/ecp_nistz.inl Show resolved Hide resolved

crypto/fipsmodule/ec/gfp_p384.c Outdated Show resolved Hide resolved

briansmith mentioned this pull request Oct 26, 2023

Add support for verifying P-521 signatures with SHA-512 and SHA-384 #1771

Open

13 tasks

yacinehmito mentioned this pull request Nov 12, 2023

invalid peer certificate: BadSignature with Cloudflare WARP denoland/deno#21169

Open

vkrasnov force-pushed the vlad/p521_verify branch from 6b2b571 to 806e855 Compare January 5, 2024 17:49

vkrasnov marked this pull request as draft January 5, 2024 17:50

vkrasnov force-pushed the vlad/p521_verify branch from 806e855 to e864d37 Compare January 5, 2024 17:58

vkrasnov force-pushed the vlad/p521_verify branch from e864d37 to 8086779 Compare January 12, 2024 13:45

vkrasnov force-pushed the vlad/p521_verify branch from 8086779 to 17c7ead Compare January 19, 2024 21:28

vkrasnov added 2 commits January 24, 2024 10:36

ec: make P384 code a little bit more generic

e05cbe6

This change makes it easier to reuse the P384 code which is quite generic already. No algorithmic changes are made, only some code is shuffled around. This prepares the ground for P521 implementation.

ec: implement P521 signature verification

7f35cec

This code almost entirely reuses the P384 code, and only implements the dedicated inversion routines on top of the code generated by generate_curves.py

vkrasnov force-pushed the vlad/p521_verify branch from 17c7ead to 561a613 Compare January 24, 2024 17:00

briansmith marked this pull request as ready for review January 25, 2024 21:07

ec: additional P521 tests from generate_tests.cc

932beef

vkrasnov force-pushed the vlad/p521_verify branch from 561a613 to 932beef Compare January 25, 2024 23:55

lino-levan mentioned this pull request Mar 28, 2024

chore(ext/crypto): move forward p521 support denoland/deno#23109

Closed

kornelski mentioned this pull request May 11, 2024

CfT: Test out Rustup's reqwest backend with rustls rust-lang/rustup#3806

Open

rami3l mentioned this pull request May 11, 2024

Lack of support for p521 signatures with the ring-based reqwest/rustls backend rust-lang/rustup#3820

Closed

This was referenced Jun 25, 2024

invalid peer certificate: BadSignature when installing package from private index using ECDSA SHA-512 SSL cert astral-sh/uv#4534

Closed

Use aws-lc-rs instead of ring for TLS astral-sh/uv#4734

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement NIST P521 signature verification #1631

Implement NIST P521 signature verification #1631

vkrasnov commented Sep 1, 2023

briansmith commented Oct 3, 2023

vkrasnov commented Oct 3, 2023

codecov bot commented Oct 6, 2023 •

edited

Loading

briansmith commented Oct 9, 2023

briansmith commented Oct 9, 2023

vkrasnov commented Oct 9, 2023

briansmith commented Oct 18, 2023

briansmith left a comment

briansmith commented Oct 25, 2023

briansmith commented Oct 25, 2023

yacinehmito commented Nov 21, 2023 •

edited

Loading

tgross35 commented Nov 30, 2023 •

edited

Loading

vkrasnov commented Jan 5, 2024

briansmith commented Jan 11, 2024

yacinehmito commented Mar 16, 2024

rami3l commented Dec 7, 2024 •

edited

Loading

Implement NIST P521 signature verification #1631

Are you sure you want to change the base?

Implement NIST P521 signature verification #1631

Conversation

vkrasnov commented Sep 1, 2023

briansmith commented Oct 3, 2023

vkrasnov commented Oct 3, 2023

codecov bot commented Oct 6, 2023 • edited Loading

Codecov Report

briansmith commented Oct 9, 2023

briansmith commented Oct 9, 2023

vkrasnov commented Oct 9, 2023

briansmith commented Oct 18, 2023

briansmith left a comment

Choose a reason for hiding this comment

briansmith commented Oct 25, 2023

briansmith commented Oct 25, 2023

yacinehmito commented Nov 21, 2023 • edited Loading

tgross35 commented Nov 30, 2023 • edited Loading

vkrasnov commented Jan 5, 2024

briansmith commented Jan 11, 2024

yacinehmito commented Mar 16, 2024

rami3l commented Dec 7, 2024 • edited Loading

codecov bot commented Oct 6, 2023 •

edited

Loading

yacinehmito commented Nov 21, 2023 •

edited

Loading

tgross35 commented Nov 30, 2023 •

edited

Loading

rami3l commented Dec 7, 2024 •

edited

Loading