Repository navigation
Accept SPKI DER in rust_crypto ECDSA verification - #553
Open
mamicicekel wants to merge 2 commits into
Open
mamicicekel wants to merge 2 commits into
mamicicekel wants to merge 2 commits into
Conversation
from_ec_der documents a DER public key, but the rust_crypto verifier only called from_sec1_bytes, so SPKI keys from OpenSSL/from_ec_pem failed while the historical 65-byte SEC1 test keys still need to work.
Collaborator
|
I don't really plan on offering sec1 support for key loading currently, this is just a mistake that I haven't gotten around to looking at yet. Just correcting it to the proper DER method is enough. |
The rust_crypto verifier no longer falls back to SEC1. PEM extraction and from_ec_components now keep SubjectPublicKeyInfo so JWK and PEM round-trips still work.
Author
|
Thanks — dropped the SEC1 fallback. The verifier only uses PEM and JWK still have to feed that parser, so |
Collaborator
|
Hm, this turned out to do more interaction with the secret than I hoped it would, I might pull this out into the dedicated key loading refactor pr after all. Good to keep open for now though, thanks for the work either way |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #497.
DecodingKey::from_ec_deris documented as taking a DER-encoded EC public key. Theaws_lc_rsverifier already accepts SubjectPublicKeyInfo;rust_cryptoalways calledfrom_sec1_bytes, so a normal SPKI key failed withInvalidEcdsaKey.The verifier now uses only
from_public_key_der. PEM (from_ec_pem) and JWK (from_ec_components) store the same SPKI DER so those loaders keep working without a SEC1 key-loading path.