Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix verify test with ecdsa-sha2-nistp384 key
Fix test, which successfully verifies a signature from an ecdsa nistp256 key, using a "ecdsa-sha2-nistp384" key. This only worked because keytype/scheme/keyval combos in an SSlibKey are not validated sufficiently (see secure-systems-lab#766). The test data was created using below snippet. Note how the signature is not created with CryptoSigner, which does not support nistp384. ``` from cryptography.hazmat.primitives.asymmetric.ec import ( ECDSA, SECP384R1, EllipticCurvePrivateKey, ) from cryptography.hazmat.primitives.hashes import SHA384 from cryptography.hazmat.primitives.serialization import load_pem_private_key from securesystemslib.signer import SSlibKey with open("tests/data/pems/ecdsa_secp384r1_private.pem", "rb") as f: priv: EllipticCurvePrivateKey = load_pem_private_key(f.read(), None) assert isinstance(priv.curve, SECP384R1) pub = SSlibKey.from_crypto(priv.public_key()) sig = priv.sign(b"DATA", ECDSA(SHA384())) print(pub.keyid) print(sig.hex()) print(repr(pub.keyval["public"]).strip("'")) ``` Signed-off-by: Lukas Puehringer <[email protected]>
- Loading branch information