[Public_key.verify]'s ECDSA evaluation mishandles long digests about ocaml-x509

[hannesm]

in Private_key.sign, the Public_key.trunc is applied as well before the Dsa.sign is called (part of 793b166). So the code you refer to is now different :)

But indeed I have not written a test for this.

[hannesm]

Oh, thanks for opening the issue. I'm travelling and will be back next week. If I understand you correctly, this is best be fixed in mirage-crypto-ec (since it affects any ECDSA signature)? Do you have any test vector for this?

[torinnd]

Mirage-crypto-ec's [verify] interface implies to me that it is up to callers to ensure their [digest] is appropriately sized. If that's the case I think ocaml-x509 should be handling the truncation (though mirage-crypto-ec has the relevant [byte_length] information, which might need to be exposed to avoid code duplication / drift). I suppose one could change the behavior of [verify] to silently handle the truncation instead of failing, but am uncertain about the safety of doing so.

I don't have the arcana involved in convincing OpenSSL to mint such a certificate chain available. I'll try to sort that out and bump this issue with the test case, if you don't get to it first.

[hannesm]

I indeed have a regression test in my ecdsa-long-digest branch, hannesm@396d67c

[hannesm]

FWIW to generate a P256 key: openssl ecparam -out server.key -name secp256r1 -genkey
to generate a CA certificate using this key: openssl req -new -x509 -key server.key -out server.pem -days 360 -sha384 -addext keyUsage=keyCertSign

[hannesm]

progress: mirage/mirage-crypto@844b059 adds byte_length to the Dsa module type in Mirage_crypto_ec.

EDIT: now PRed as mirage-crypto 0.10.7 (ocaml/opam-repository#22103)

[hannesm]

see #159 for a test and fix. does this work for you?

[torinnd]

I am not familiar enough with [Cstruct] to opine on the correctness of [Cstruct.sub] vs [Cstruct.take]. Naively I might've assumed it was always safe to call [Cstruct.take], but I expect this is semantically the same thing!

[hannesm]

Cstruct.take is pretty new, and I have not used it anywhere ;) That's my reasoning for using Cstruct.sub (which has been around since ever) ;)

[torinnd]

Oh, that only addresses the verify step. Did you look at whether signing works as well? Based on the MLI: "@raise Message_too_long if the bit size of [msg] exceeds the curve." it looks like there's the same problem around here:

ocaml-x509/lib/private_key.ml

Lines 106 to 112 in e87d4ba

	| #ecdsa as key, `ECDSA ->
	let* d = hashed () in
	Ok (ecdsa_to_cs (match key with
	| `P224 key -> P224.Dsa.sign ~key d
	| `P256 key -> P256.Dsa.sign ~key d
	| `P384 key -> P384.Dsa.sign ~key d
	| `P521 key -> P521.Dsa.sign ~key d))

[hannesm]

I manually tested sign with a modified ocaml-certify and openssl locally, merged the PR and cut a release. Thanks again for opening this issue.