Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add RSA variants, experimental LMS and LM-OTS to algorithm registry #199

Merged
merged 7 commits into from
Feb 5, 2024
Merged

Add RSA variants, experimental LMS and LM-OTS to algorithm registry #199

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
20452d6
algorithm-registry: add LMS and LM-OTS
woodruffw Jan 19, 2024
139b502
add LMS and LM-OTS to algo registry
woodruffw Jan 19, 2024
1a8ee2c
Merge remote-tracking branch 'upstream/main' into ww/lms-registry
woodruffw Feb 2, 2024
922b28c
add RSA PSS variants
woodruffw Feb 2, 2024
d8d4b20
document PSS variants, make it clear they're PKIX encoded
woodruffw Feb 2, 2024
f490da0
linearize all RSA variants
woodruffw Feb 2, 2024
c0b8863
drop PCKS1 key encodings
woodruffw Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 24 additions & 10 deletions docs/algorithm-registry.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,16 +15,30 @@ specification for the design rationale for this registry.

## Signature Algorithms

| Algorithm | Name | Usage |
|-----------|----------------------------|---------------------------------------------------|
| RSA | rsa-sign-pkcs1-2048-sha256 | verify only |
| | rsa-sign-pkcs1-3072-sha256 | sign/verify |
| | rsa-sign-pkcs1-4096-sha256 | sign/verify |
| ECDSA | ecdsa-sha2-256-nistp256 | sign/verify |
| | ecdsa-sha2-384-nistp384 | sign/verify |
| | ecdsa-sha2-512-nistp521 | sign/verify |
| EdDSA | ed25519 | sign/verify |
| | ed25519-ph | sign/verify (recommended only for `hashedrekord`) |
| Algorithm | Name | Usage | Notes |
|-----------|----------------------------|-------------| -------------------------------------------------------------------------------- |
| RSA | rsa-sign-pkcs1-2048-sha256 | verify only | |
| | rsa-sign-pkcs1-3072-sha256 | sign/verify | |
| | rsa-sign-pkcs1-4096-sha256 | sign/verify | |
| ECDSA | ecdsa-sha2-256-nistp256 | sign/verify | |
| | ecdsa-sha2-384-nistp384 | sign/verify | |
| | ecdsa-sha2-512-nistp521 | sign/verify | |
| EdDSA | ed25519 | sign/verify | |
| | ed25519-ph | sign/verify | Recommended only for `hashedrekord`. |
| LMS | lms-sha256 | sign/verify | Stateful; signer selects the `H` parameter. Not recommended for keyless signing. |
woodruffw marked this conversation as resolved.
Show resolved Hide resolved
| LM-OTS | lmots-sha256 | sign/verify | One-time use only; signer selects `n` and `w`. |

### Parameter configuration for LMS and LM-OTS

LMS and LM-OTS are both hash-based signature schemes. Both require the signing party
to make parameter choices during key generation.

In both cases, the selected parameters are encoded in the public key representation.
See [RFC 8554 S5.3](https://www.rfc-editor.org/rfc/rfc8554.html#section-5.3) for LMS and
[RFC 8554 S4.3](https://www.rfc-editor.org/rfc/rfc8554.html#section-4.3) for LM-OTS public key
formats. Additionally, see [RFC 8708 S4](https://www.rfc-editor.org/rfc/rfc8708.html) for
`SubjectPublicKeyInfo` and `AlgorithmIdentifier` encodings for both LMS and LM-OTS
public keys.

## Hash Algorithms

Expand Down
62 changes: 35 additions & 27 deletions gen/pb-go/common/v1/sigstore_common.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions gen/pb-python/sigstore_protobuf_specs/dev/sigstore/common/v1/__init__.py
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions gen/pb-ruby/lib/sigstore_common_pb.rb
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions gen/pb-typescript/src/__generated__/sigstore_common.ts
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions protos/sigstore_common.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,8 @@ enum KnownSignatureAlgorithm {
ECDSA_SHA2_512_NISTP521 = 6;
ED25519 = 7;
ED25519_PH = 8;
LMS_SHA256 = 9;
LMOTS_SHA256 = 10;
}

// MessageSignature stores the computed signature over a message.
Expand Down