Skip to content

Commit b80a630

Browse files
twisstwiss
committed
Properly specify the encoding when verifying ECDSA signatures
When verifying an ECDSA signature, properly specify how to convert the byte sequence to a pair of integers, which RFC 6090 requires, by referring to the Octet-String-to-Integer Conversion steps in RFC 6090. If the signature is of an incorrect length, return false, as the web platform tests require and all implementations seem to do. Similarly, when signing, refer to the Integer-to-Octet-String Conversion steps in RFC 6090 instead of specifying our own conversion from a byte sequence to an integer. Also, refer to the proper sections for signing and verifying in RFC 6090. The subsections 5.4.2 and 5.4.3 refer to "KT-I signatures", which are equivalent to ECDSA signatures, while section 5.3 refers to "KT-IV signatures", which are encoded differently. Finally, harmonize the parameter names with those specified in RFC 6090.
1 parent 43f2f62 commit b80a630

File tree

1 file changed

+61
-38
lines changed

1 file changed

+61
-38
lines changed

‎spec/Overview.html‎

Lines changed: 61 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -624,15 +624,6 @@ <h2>Terminology</h2>
624624
bits of value zero to |b| such that the length of the resulting bit sequence is minimal and an integer multiple of 8
625625
and then considering each consecutive sequence of 8 bits in that string as a byte.
626626
</p>
627-
<p>
628-
When this specification says to <dfn id="dfn-convert-integer-to-byte-sequence">convert a non-negative
629-
integer |i| to a byte sequence of length |n|</dfn>, where |n| * 8
630-
is greater than the logarithm to base 2 of |i|, the user agent must
631-
first calculate the binary representation of |i|, most significant bit first,
632-
prefix this with sufficient zero bits to form a bit sequence of length |n| * 8, and
633-
then return the [= byte sequence =] formed by considering each consecutive
634-
sequence of 8 bits in that bit sequence as a byte.
635-
</p>
636627
<p>
637628
Comparing two strings in a <dfn id="case-sensitive">case-sensitive</dfn>
638629
manner means comparing them exactly, code point for code point.
@@ -7108,13 +7099,13 @@ <h5>Sign</h5>
71087099
</li>
71097100
<li>
71107101
<p>
7111-
Let |M| be the result of performing the digest operation specified by
7102+
Let |m| be the result of performing the digest operation specified by
71127103
|hashAlgorithm| using |message|.
71137104
</p>
71147105
</li>
71157106
<li>
71167107
<p>
7117-
Let |d| be the ECDSA private key associated with |key|.
7108+
Let |z| be the ECDSA private key associated with |key|.
71187109
</p>
71197110
</li>
71207111
<li>
@@ -7135,14 +7126,15 @@ <h5>Sign</h5>
71357126
<li>
71367127
<p>
71377128
Perform the ECDSA signing process, as specified in [[RFC6090]],
7138-
Section 5.4, with |M| as the message, using |params| as the
7139-
EC domain parameters, and with |d| as the private key.
7129+
Section 5.4.2, with |m| as the message,
7130+
and |z| as the private key,
7131+
using |params| as the EC domain parameters.
71407132
</p>
71417133
</li>
71427134
<li>
71437135
<p>
7144-
Let |r| and |s| be the pair of integers resulting from
7145-
performing the ECDSA signing process.
7136+
Let |s1| and |s2| be the pair of integers resulting from
7137+
performing the ECDSA signing process.
71467138
</p>
71477139
</li>
71487140
<li>
@@ -7152,21 +7144,18 @@ <h5>Sign</h5>
71527144
</li>
71537145
<li>
71547146
<p>
7155-
Let |n| be the smallest integer such that |n| * 8 is greater than
7156-
the logarithm to base 2 of the order of the base point of the elliptic curve identified
7157-
by |params|.
7158-
</p>
7159-
</li>
7160-
<li>
7161-
<p>
7162-
<a href="#dfn-convert-integer-to-byte-sequence">Convert |r| to a byte sequence of
7163-
length |n|</a> and append it to |result|.
7147+
Perform the Integer-to-Octet-String Conversion,
7148+
as specified in [[RFC6090]], Section 6.2,
7149+
with |s1| as the integer |x|,
7150+
and append the result to |result|.
71647151
</p>
71657152
</li>
71667153
<li>
71677154
<p>
7168-
<a href="#dfn-convert-integer-to-byte-sequence">Convert |s| to a byte sequence of
7169-
length |n|</a> and append it to |result|.
7155+
Perform the Integer-to-Octet-String Conversion,
7156+
as specified in [[RFC6090]], Section 6.2,
7157+
with |s2| as the integer |x|,
7158+
and append the result to |result|.
71707159
</p>
71717160
</li>
71727161
</ol>
@@ -7180,8 +7169,8 @@ <h5>Sign</h5>
71807169
<dd>
71817170
<p>
71827171
Perform the [= ECDSA signature steps =]
7183-
specified in that specification, passing in |M|, |params|
7184-
and |d| and resulting in |result|.
7172+
specified in that specification, passing in |m|, |z|,
7173+
and |params|, and resulting in |result|.
71857174
</p>
71867175
</dd>
71877176
</dl>
@@ -7212,13 +7201,13 @@ <h5>Verify</h5>
72127201
</li>
72137202
<li>
72147203
<p>
7215-
Let |M| be the result of performing the digest operation specified by
7204+
Let |m| be the result of performing the digest operation specified by
72167205
|hashAlgorithm| using |message|.
72177206
</p>
72187207
</li>
72197208
<li>
72207209
<p>
7221-
Let |Q| be the ECDSA public key associated with |key|.
7210+
Let |Y| be the ECDSA public key associated with |key|.
72227211
</p>
72237212
</li>
72247213
<li>
@@ -7235,12 +7224,46 @@ <h5>Verify</h5>
72357224
|key| is "`P-256`", "`P-384`" or "`P-521`":
72367225
</dt>
72377226
<dd>
7238-
<p>
7239-
Perform the ECDSA verifying process, as specified in [[RFC6090]], Section 5.3, with |M| as the received
7240-
message, |signature| as the received signature and using
7241-
|params| as the EC domain parameters, and
7242-
|Q| as the public key.
7243-
</p>
7227+
<ol>
7228+
<li>
7229+
<p>
7230+
Let |n| be the smallest integer such that |n| * 8 is greater than
7231+
the logarithm to base 2 of the order of the base point of the elliptic curve identified
7232+
by |params|.
7233+
</p>
7234+
</li>
7235+
<li>
7236+
<p>
7237+
If |signature| does not have a [= byte sequence/length =] of |n| * 2 bytes,
7238+
then return false.
7239+
</p>
7240+
</li>
7241+
<li>
7242+
<p>
7243+
Let |s1| be the result of performing the
7244+
Octet-String-to-Integer Conversion,
7245+
as specified in [[RFC6090]], Section 6.1,
7246+
with the first |n| bytes of |signature| as the octet string |S|.
7247+
</p>
7248+
</li>
7249+
<li>
7250+
<p>
7251+
Let |s2| be the result of performing the
7252+
Octet-String-to-Integer Conversion,
7253+
as specified in [[RFC6090]], Section 6.1,
7254+
with the last |n| bytes of |signature| as the octet string |S|.
7255+
</p>
7256+
</li>
7257+
<li>
7258+
<p>
7259+
Perform the ECDSA verifying process, as specified in [[RFC6090]],
7260+
Section 5.4.3, with |m| as the message,
7261+
(|s1|, |s2|) as the signature,
7262+
and |Y| as the public key,
7263+
using |params| as the EC domain parameters.
7264+
</p>
7265+
</li>
7266+
</ol>
72447267
</dd>
72457268
<dt>
72467269
Otherwise, the {{EcKeyAlgorithm/namedCurve}} attribute
@@ -7251,8 +7274,8 @@ <h5>Verify</h5>
72517274
<dd>
72527275
<p>
72537276
Perform the [= ECDSA verification steps =]
7254-
specified in that specification passing in |M|, |signature|,
7255-
|params| and |Q| and resulting in an indication of whether
7277+
specified in that specification passing in |m|, |signature|,
7278+
|Y|, and |params|, and resulting in an indication of whether
72567279
or not the purported signature is valid.
72577280
</p>
72587281
</dd>

0 commit comments

Comments
 (0)