Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"ecdsa-sha2-nistp256" wrongly used as default scheme for any "ecdsa" key #669

Closed
lukpueh opened this issue Nov 2, 2023 · 0 comments · Fixed by #763
Closed

"ecdsa-sha2-nistp256" wrongly used as default scheme for any "ecdsa" key #669

lukpueh opened this issue Nov 2, 2023 · 0 comments · Fixed by #763
Labels
bug contribfest Issues for KubeCon EU contribfest good first issue

Comments

@lukpueh
Copy link
Member

lukpueh commented Nov 2, 2023

Description of issue or feature request:
ecdsa has repeatedly been a source of confusion for securesystemslib and its users:
#239, #363, #513, theupdateframework/specification#272, theupdateframework/python-tuf#1388, theupdateframework/go-tuf#508

This is because supported ecdsa signing schemes contain additional details, which either can vary for a given key (hash, e.g. sha2) or cannot (curve, e.g. nistp256).

For comparison, rsa signing schemes only contain details, which can vary (padding, e.g. pss, and hash, eg. sha256).

Current behavior:
There is at least one case, where securesystemslib code uses "ecdsa-sha2-nistp256" as the default scheme for any "ecdsa" key, even if that key uses a different curve:

>>> from securesystemslib.signer import SSlibKey
>>> from cryptography.hazmat.primitives.asymmetric import ec
>>> 
>>> nistp384 = ec.SECP384R1()
>>> private = ec.generate_private_key(ec.SECP384R1())
>>> public = SSlibKey._from_crypto_public_key(private.public_key(), None, None)
>>> public.scheme
'ecdsa-sha2-nistp256'

Expected behavior:

  • Fix above
  • Bonus: Check if there are other occurrences, where this happens
@lukpueh lukpueh added the bug label Nov 2, 2023
@lukpueh lukpueh added the contribfest Issues for KubeCon EU contribfest label Mar 14, 2024
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 2, 2024
fixes secure-systems-lab#669

Fix SSlibKey.from_crypto to assign the correct default scheme, for
ecdsa nistp384 keys.

This includes refactoring from_crypto to use a single switch over
pyca/cryptography public key object type, in order to infer
securesystemslib "keytype" and default scheme.

Previously, only "keytype" was inferred from the key object, and the
default scheme then from the keytype. Given that for the same keytype
(ecdsa) there can be different default schemes, this needed to be
changed.

The refactoring also moves the keytype-specific public key value
serialization to the same switch.

Signed-off-by: Lukas Puehringer <[email protected]>
lukpueh added a commit to lukpueh/securesystemslib that referenced this issue Apr 2, 2024
fixes secure-systems-lab#669

Fix SSlibKey.from_crypto to assign the correct default scheme, for
ecdsa nistp384 keys.

This includes refactoring from_crypto to use a single switch over
pyca/cryptography public key object type, in order to infer
securesystemslib "keytype" and default scheme.

Previously, only "keytype" was inferred from the key object, and the
default scheme then from the keytype. Given that for the same keytype
(ecdsa) there can be different default schemes, this needed to be
changed.

The refactoring also moves the keytype-specific public key value
serialization to the same switch.

Signed-off-by: Lukas Puehringer <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug contribfest Issues for KubeCon EU contribfest good first issue
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant