commonware_cryptography/secp256r1/
standard.rs

1cfg_if::cfg_if! {
2    if #[cfg(feature = "std")] {
3        use std::borrow::Cow;
4    } else {
5        use alloc::borrow::Cow;
6    }
7}
8use super::common::{
9    CURVE_NAME, PRIVATE_KEY_LENGTH, PUBLIC_KEY_LENGTH, PrivateKeyInner, PublicKeyInner,
10    impl_private_key_wrapper, impl_public_key_wrapper,
11};
12#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
13use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED, UnparsedPublicKey};
14use bytes::BufMut;
15use commonware_codec::{Buf, Error as CodecError, FixedArray, FixedSize, Read, ReadExt, Write};
16use commonware_formatting::Hex;
17use commonware_utils::{Array, Span, union_unique};
18use core::{
19    fmt::{Debug, Display},
20    hash::{Hash, Hasher},
21    ops::Deref,
22};
23#[cfg(not(any(target_arch = "x86_64", target_arch = "aarch64")))]
24use p256::ecdsa::signature::Verifier;
25use p256::{ecdsa::signature::Signer, elliptic_curve::scalar::IsHigh};
26
27const SIGNATURE_LENGTH: usize = 64; // R || S
28
29/// Secp256r1 Private Key.
30#[derive(Clone, Eq, PartialEq)]
31pub struct PrivateKey(PrivateKeyInner);
32
33impl_private_key_wrapper!(PrivateKey);
34
35impl crate::Signer for PrivateKey {
36    type Signature = Signature;
37    type PublicKey = PublicKey;
38
39    fn sign(&self, namespace: &[u8], msg: &[u8]) -> Self::Signature {
40        self.sign_inner(Some(namespace), msg)
41    }
42
43    fn public_key(&self) -> Self::PublicKey {
44        PublicKey(PublicKeyInner::from_private_key(&self.0))
45    }
46}
47
48impl PrivateKey {
49    #[inline(always)]
50    fn sign_inner(&self, namespace: Option<&[u8]>, msg: &[u8]) -> Signature {
51        let payload = namespace.map_or(Cow::Borrowed(msg), |namespace| {
52            Cow::Owned(union_unique(namespace, msg))
53        });
54        let signature: p256::ecdsa::Signature = self.0.key.expose(|key| key.sign(&payload));
55        let signature = signature.normalize_s();
56        Signature::try_from(signature).expect("freshly signed signature is valid")
57    }
58}
59
60impl From<PrivateKey> for PublicKey {
61    fn from(value: PrivateKey) -> Self {
62        Self(PublicKeyInner::from_private_key(&value.0))
63    }
64}
65
66/// Secp256r1 Public Key.
67#[derive(Clone, Eq, PartialEq, Ord, PartialOrd, FixedArray)]
68#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
69pub struct PublicKey(PublicKeyInner);
70
71impl_public_key_wrapper!(PublicKey);
72
73impl crate::Verifier for PublicKey {
74    type Signature = Signature;
75
76    fn verify(&self, namespace: &[u8], msg: &[u8], sig: &Self::Signature) -> bool {
77        self.verify_inner(Some(namespace), msg, sig)
78    }
79}
80
81impl PublicKey {
82    #[cfg(not(any(target_arch = "x86_64", target_arch = "aarch64")))]
83    #[inline(always)]
84    fn verify_inner(&self, namespace: Option<&[u8]>, msg: &[u8], sig: &Signature) -> bool {
85        let payload = namespace.map_or(Cow::Borrowed(msg), |namespace| {
86            Cow::Owned(union_unique(namespace, msg))
87        });
88        self.0.key.verify(&payload, &sig.signature).is_ok()
89    }
90
91    #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
92    #[inline(always)]
93    fn verify_inner(&self, namespace: Option<&[u8]>, msg: &[u8], sig: &Signature) -> bool {
94        let payload = namespace.map_or(Cow::Borrowed(msg), |namespace| {
95            Cow::Owned(union_unique(namespace, msg))
96        });
97        let uncompressed = self.0.to_uncompressed();
98        let public_key = UnparsedPublicKey::new(&ECDSA_P256_SHA256_FIXED, &uncompressed);
99        public_key.verify(&payload, &sig.raw).is_ok()
100    }
101}
102
103/// Secp256r1 Signature.
104#[derive(Clone, Eq, PartialEq, FixedArray)]
105pub struct Signature {
106    raw: [u8; SIGNATURE_LENGTH],
107    signature: p256::ecdsa::Signature,
108}
109
110impl crate::Signature for Signature {}
111
112impl Write for Signature {
113    fn write(&self, buf: &mut impl BufMut) {
114        self.raw.write(buf);
115    }
116}
117
118impl Read for Signature {
119    type Cfg = ();
120
121    fn read_cfg(buf: &mut impl Buf, _: &()) -> Result<Self, CodecError> {
122        let raw = <[u8; Self::SIZE]>::read(buf)?;
123        let result = p256::ecdsa::Signature::from_slice(&raw);
124        #[cfg(feature = "std")]
125        let signature = result.map_err(|e| CodecError::Wrapped(CURVE_NAME, e.into()))?;
126        #[cfg(not(feature = "std"))]
127        let signature = result
128            .map_err(|e| CodecError::Wrapped(CURVE_NAME, alloc::format!("{:?}", e).into()))?;
129        // Reject any signatures with a `s` value in the upper half of the curve order.
130        if signature.s().is_high().into() {
131            return Err(CodecError::Invalid(CURVE_NAME, "Signature S is high"));
132        }
133        Ok(Self { raw, signature })
134    }
135}
136
137impl FixedSize for Signature {
138    const SIZE: usize = SIGNATURE_LENGTH;
139}
140
141impl Span for Signature {}
142
143impl Array for Signature {}
144
145impl Hash for Signature {
146    fn hash<H: Hasher>(&self, state: &mut H) {
147        self.raw.hash(state);
148    }
149}
150
151impl Ord for Signature {
152    fn cmp(&self, other: &Self) -> core::cmp::Ordering {
153        self.raw.cmp(&other.raw)
154    }
155}
156
157impl PartialOrd for Signature {
158    fn partial_cmp(&self, other: &Self) -> Option<core::cmp::Ordering> {
159        Some(self.cmp(other))
160    }
161}
162
163impl AsRef<[u8]> for Signature {
164    fn as_ref(&self) -> &[u8] {
165        &self.raw
166    }
167}
168
169impl Deref for Signature {
170    type Target = [u8];
171    fn deref(&self) -> &[u8] {
172        &self.raw
173    }
174}
175
176impl TryFrom<p256::ecdsa::Signature> for Signature {
177    type Error = CodecError;
178
179    fn try_from(value: p256::ecdsa::Signature) -> Result<Self, Self::Error> {
180        let raw: [u8; _] = value.to_bytes().into();
181        Self::try_from(raw)
182    }
183}
184
185impl Debug for Signature {
186    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
187        write!(f, "{}", Hex(&self.raw))
188    }
189}
190
191impl Display for Signature {
192    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
193        write!(f, "{}", Hex(&self.raw))
194    }
195}
196
197#[cfg(feature = "arbitrary")]
198impl arbitrary::Arbitrary<'_> for Signature {
199    fn arbitrary(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<Self> {
200        use crate::Signer;
201        use commonware_math::algebra::Random;
202        use rand::{SeedableRng, rngs::StdRng};
203
204        let mut rand = StdRng::from_seed(u.arbitrary::<[u8; 32]>()?);
205        let private_key = PrivateKey(PrivateKeyInner::random(&mut rand));
206        let len = u.arbitrary::<usize>()? % 256;
207        let message = u
208            .arbitrary_iter()?
209            .take(len)
210            .collect::<Result<Vec<_>, _>>()?;
211
212        Ok(private_key.sign(&[], &message))
213    }
214}
215
216#[cfg(test)]
217mod tests {
218    use super::*;
219    use crate::{Signer as _, Verifier as _, secp256r1::common::tests::*};
220    use commonware_codec::{Copying, DecodeExt, Encode};
221    use p256::elliptic_curve::scalar::IsHigh;
222    use rstest::rstest;
223
224    const NAMESPACE: &[u8] = b"test-namespace";
225
226    #[test]
227    fn test_codec_private_key() {
228        let original = PrivateKey(create_private_key());
229        let encoded = original.encode();
230        assert_eq!(encoded.len(), PRIVATE_KEY_LENGTH);
231
232        let decoded = PrivateKey::decode(encoded).unwrap();
233        assert_eq!(original, decoded);
234    }
235
236    #[test]
237    fn test_codec_public_key() {
238        let private_key = PrivateKey(create_private_key());
239        let original = PublicKey::from(private_key);
240
241        let encoded = original.encode();
242        assert_eq!(encoded.len(), PUBLIC_KEY_LENGTH);
243
244        let decoded = PublicKey::decode(encoded).unwrap();
245        assert_eq!(original, decoded);
246    }
247
248    #[test]
249    fn test_codec_signature() {
250        let private_key = PrivateKey(create_private_key());
251        let original = private_key.sign(NAMESPACE, "Hello World".as_bytes());
252
253        let encoded = original.encode();
254        assert_eq!(encoded.len(), SIGNATURE_LENGTH);
255
256        let decoded = Signature::decode(encoded).unwrap();
257        assert_eq!(original, decoded);
258    }
259
260    #[test]
261    fn test_codec_signature_invalid() {
262        let (_, sig, ..) = vector_sig_verification_5();
263        let result = Signature::decode(sig);
264        assert!(result.is_err());
265    }
266
267    #[test]
268    fn test_scheme_sign() {
269        let private_key: PrivateKey = PrivateKey::decode(
270            commonware_formatting::from_hex(
271                "519b423d715f8b581f4fa8ee59f4771a5b44c8130b4e3eacca54a56dda72b464",
272            )
273            .unwrap(),
274        )
275        .unwrap();
276        let public_key: PublicKey = private_key.clone().into();
277        let message = commonware_formatting::from_hex(
278            "5905238877c77421f73e43ee3da6f2d9e2ccad5fc942dcec0cbd25482935faaf416983fe165b1a045e
279            e2bcd2e6dca3bdf46c4310a7461f9a37960ca672d3feb5473e253605fb1ddfd28065b53cb5858a8ad28175bf
280            9bd386a5e471ea7a65c17cc934a9d791e91491eb3754d03799790fe2d308d16146d5c9b0d0debd97d79ce8",
281        )
282        .unwrap();
283        let signature = private_key.sign(NAMESPACE, &message);
284        assert_eq!(SIGNATURE_LENGTH, signature.len());
285        assert!(public_key.verify(NAMESPACE, &message, &signature));
286    }
287
288    #[test]
289    fn test_decode_zero_signature_fails() {
290        let result = Signature::decode(vec![0u8; SIGNATURE_LENGTH]);
291        assert!(result.is_err());
292    }
293
294    #[test]
295    fn test_decode_high_s_signature_fails() {
296        let (inner, _) = vector_keypair_1();
297        let private_key = PrivateKey(inner);
298        let message = b"edge";
299        let signature = private_key.sign(NAMESPACE, message);
300        let mut bad_signature = signature.to_vec();
301        bad_signature[32] |= 0x80;
302        assert!(Signature::decode(bad_signature).is_err());
303    }
304
305    #[test]
306    fn test_decode_zero_r_signature_fails() {
307        let (inner, _) = vector_keypair_1();
308        let private_key = PrivateKey(inner);
309        let message = b"edge";
310        let signature = private_key.sign(NAMESPACE, message);
311        let mut bad_signature = signature.to_vec();
312        for b in bad_signature.iter_mut().take(32) {
313            *b = 0x00;
314        }
315        bad_signature[32] = 1;
316        assert!(Signature::decode(bad_signature).is_err());
317    }
318
319    #[test]
320    fn test_rfc6979() {
321        let private_key: PrivateKey = PrivateKey::decode(
322            commonware_formatting::from_hex(
323                "c9afa9d845ba75166b5c215767b1d6934e50c3db36e89b127b8a622b120f6721",
324            )
325            .unwrap(),
326        )
327        .unwrap();
328
329        let (message, exp_sig) = (
330            b"sample",
331            p256::ecdsa::Signature::from_slice(
332                &commonware_formatting::from_hex(
333                    "efd48b2aacb6a8fd1140dd9cd45e81d69d2c877b56aaf991c34d0ea84eaf3716
334                    f7cb1c942d657c41d436c7a1b6e29f65f3e900dbb9aff4064dc4ab2f843acda8",
335                )
336                .unwrap(),
337            )
338            .unwrap(),
339        );
340        let signature = private_key.sign_inner(None, message);
341        assert_eq!(signature.to_vec(), exp_sig.normalize_s().to_vec());
342
343        let (message, exp_sig) = (
344            b"test",
345            p256::ecdsa::Signature::from_slice(
346                &commonware_formatting::from_hex(
347                    "f1abb023518351cd71d881567b1ea663ed3efcf6c5132b354f28d3b0b7d38367
348                    019f4113742a2b14bd25926b49c649155f267e60d3814b4c0cc84250e46f0083",
349                )
350                .unwrap(),
351            )
352            .unwrap(),
353        );
354
355        let signature = private_key.sign_inner(None, message);
356        assert_eq!(signature.to_vec(), exp_sig.to_vec());
357    }
358
359    #[test]
360    fn test_scheme_validate_public_key_too_long() {
361        let qx_hex = "d0720dc691aa80096ba32fed1cb97c2b620690d06de0317b8618d5ce65eb728f";
362        let qy_hex = "d0720dc691aa80096ba32fed1cb97c2b620690d06de0317b8618d5ce65eb728f";
363
364        let uncompressed_public_key = parse_public_key_as_uncompressed_vector(qx_hex, qy_hex);
365        let public_key = PublicKey::decode(uncompressed_public_key);
366        assert!(matches!(public_key, Err(CodecError::Invalid(_, _))));
367
368        let mut compressed_public_key = parse_public_key_as_compressed_vector(qx_hex, qy_hex);
369        compressed_public_key.push(0u8);
370        let public_key = PublicKey::decode(compressed_public_key);
371        assert!(matches!(public_key, Err(CodecError::ExtraData(1))));
372
373        let compressed_public_key = parse_public_key_as_compressed_vector(qx_hex, qy_hex);
374        let public_key = PublicKey::decode(compressed_public_key);
375        assert!(public_key.is_ok());
376    }
377
378    #[test]
379    fn test_scheme_verify_signature_r0() {
380        let private_key: PrivateKey = PrivateKey::decode(
381            commonware_formatting::from_hex(
382                "c9806898a0334916c860748880a541f093b579a9b1f32934d86c363c39800357",
383            )
384            .unwrap(),
385        )
386        .unwrap();
387        let message = b"sample";
388        let signature = private_key.sign_inner(None, message);
389        let (_, s) = signature.split_at(32);
390        let mut signature: Vec<u8> = vec![0x00; 32];
391        signature.extend_from_slice(s);
392
393        assert!(Signature::decode(signature).is_err());
394    }
395
396    #[test]
397    fn test_scheme_verify_signature_s0() {
398        let private_key: PrivateKey = PrivateKey::decode(
399            commonware_formatting::from_hex(
400                "c9806898a0334916c860748880a541f093b579a9b1f32934d86c363c39800357",
401            )
402            .unwrap(),
403        )
404        .unwrap();
405        let message = b"sample";
406        let signature = private_key.sign_inner(None, message);
407        let (r, _) = signature.split_at(32);
408        let s: Vec<u8> = vec![0x00; 32];
409        let mut signature = r.to_vec();
410        signature.extend(s);
411
412        assert!(Signature::decode(signature).is_err());
413    }
414
415    #[rstest]
416    #[case(vector_keypair_1())]
417    #[case(vector_keypair_2())]
418    #[case(vector_keypair_3())]
419    #[case(vector_keypair_4())]
420    #[case(vector_keypair_5())]
421    #[case(vector_keypair_6())]
422    #[case(vector_keypair_7())]
423    #[case(vector_keypair_8())]
424    #[case(vector_keypair_9())]
425    #[case(vector_keypair_10())]
426    fn test_keypairs(#[case] (inner_priv, inner_pub): (PrivateKeyInner, PublicKeyInner)) {
427        let private_key = PrivateKey(inner_priv);
428        let public_key = PublicKey::from(private_key);
429        let exp_public_key = PublicKey(inner_pub);
430        assert_eq!(exp_public_key, public_key);
431        assert!(public_key.len() == PUBLIC_KEY_LENGTH);
432    }
433
434    #[rstest]
435    #[case(1, vector_public_key_validation_1())]
436    #[case(3, vector_public_key_validation_3())]
437    #[case(4, vector_public_key_validation_4())]
438    #[case(5, vector_public_key_validation_5())]
439    #[case(6, vector_public_key_validation_6())]
440    #[case(7, vector_public_key_validation_7())]
441    #[case(8, vector_public_key_validation_8())]
442    #[case(9, vector_public_key_validation_9())]
443    #[case(10, vector_public_key_validation_10())]
444    #[case(12, vector_public_key_validation_12())]
445    fn test_public_key_validation(
446        #[case] n: usize,
447        #[case] (public_key, exp_valid): (Vec<u8>, bool),
448    ) {
449        let res = PublicKey::decode(public_key);
450        assert_eq!(exp_valid, res.is_ok(), "vector_public_key_validation_{n}");
451    }
452
453    fn vector_sig_verification_1() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
454        let (public_key, sig, message, expected) = vector_sig_verification_1_raw();
455        (PublicKey(public_key), sig.to_vec(), message, expected)
456    }
457
458    fn vector_sig_verification_2() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
459        let (public_key, sig, message, expected) = vector_sig_verification_2_raw();
460        (PublicKey(public_key), sig.to_vec(), message, expected)
461    }
462
463    fn vector_sig_verification_3() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
464        let (public_key, sig, message, expected) = vector_sig_verification_3_raw();
465        (PublicKey(public_key), sig.to_vec(), message, expected)
466    }
467
468    fn vector_sig_verification_4() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
469        let (public_key, sig, message, expected) = vector_sig_verification_4_raw();
470        (PublicKey(public_key), sig.to_vec(), message, expected)
471    }
472
473    fn vector_sig_verification_5() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
474        let (public_key, sig, message, expected) = vector_sig_verification_5_raw();
475        (PublicKey(public_key), sig.to_vec(), message, expected)
476    }
477
478    fn vector_sig_verification_6() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
479        let (public_key, sig, message, expected) = vector_sig_verification_6_raw();
480        (PublicKey(public_key), sig.to_vec(), message, expected)
481    }
482
483    fn vector_sig_verification_7() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
484        let (public_key, sig, message, expected) = vector_sig_verification_7_raw();
485        (PublicKey(public_key), sig.to_vec(), message, expected)
486    }
487
488    fn vector_sig_verification_8() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
489        let (public_key, sig, message, expected) = vector_sig_verification_8_raw();
490        (PublicKey(public_key), sig.to_vec(), message, expected)
491    }
492
493    fn vector_sig_verification_9() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
494        let (public_key, sig, message, expected) = vector_sig_verification_9_raw();
495        (PublicKey(public_key), sig.to_vec(), message, expected)
496    }
497
498    fn vector_sig_verification_10() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
499        let (public_key, sig, message, expected) = vector_sig_verification_10_raw();
500        (PublicKey(public_key), sig.to_vec(), message, expected)
501    }
502
503    fn vector_sig_verification_11() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
504        let (public_key, sig, message, expected) = vector_sig_verification_11_raw();
505        (PublicKey(public_key), sig.to_vec(), message, expected)
506    }
507
508    fn vector_sig_verification_12() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
509        let (public_key, sig, message, expected) = vector_sig_verification_12_raw();
510        (PublicKey(public_key), sig.to_vec(), message, expected)
511    }
512
513    fn vector_sig_verification_13() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
514        let (public_key, sig, message, expected) = vector_sig_verification_13_raw();
515        (PublicKey(public_key), sig.to_vec(), message, expected)
516    }
517
518    fn vector_sig_verification_14() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
519        let (public_key, sig, message, expected) = vector_sig_verification_14_raw();
520        (PublicKey(public_key), sig.to_vec(), message, expected)
521    }
522
523    fn vector_sig_verification_15() -> (PublicKey, Vec<u8>, Vec<u8>, bool) {
524        let (public_key, sig, message, expected) = vector_sig_verification_15_raw();
525        (PublicKey(public_key), sig.to_vec(), message, expected)
526    }
527
528    #[rstest]
529    #[case(vector_sig_verification_1())]
530    #[case(vector_sig_verification_2())]
531    #[case(vector_sig_verification_3())]
532    #[case(vector_sig_verification_4())]
533    #[case(vector_sig_verification_5())]
534    #[case(vector_sig_verification_6())]
535    #[case(vector_sig_verification_7())]
536    #[case(vector_sig_verification_8())]
537    #[case(vector_sig_verification_9())]
538    #[case(vector_sig_verification_10())]
539    #[case(vector_sig_verification_11())]
540    #[case(vector_sig_verification_12())]
541    #[case(vector_sig_verification_13())]
542    #[case(vector_sig_verification_14())]
543    #[case(vector_sig_verification_15())]
544    fn test_signature_verification(
545        #[case] (public_key, sig, message, expected): (PublicKey, Vec<u8>, Vec<u8>, bool),
546    ) {
547        let expected = if expected {
548            let mut ecdsa_signature = p256::ecdsa::Signature::from_slice(&sig).unwrap();
549            if ecdsa_signature.s().is_high().into() {
550                assert!(Signature::decode(Copying(&sig)).is_err());
551                assert!(Signature::decode(sig).is_err());
552
553                ecdsa_signature = ecdsa_signature.normalize_s();
554            }
555            let signature = Signature::try_from(ecdsa_signature).unwrap();
556            public_key.verify_inner(None, &message, &signature)
557        } else {
558            let tf_res = Signature::decode(Copying(&sig));
559            let dc_res = Signature::decode(sig);
560            if tf_res.is_err() && dc_res.is_err() {
561                true
562            } else {
563                let f1 = !public_key.verify_inner(None, &message, &tf_res.unwrap());
564                let f2 = !public_key.verify_inner(None, &message, &dc_res.unwrap());
565                f1 && f2
566            }
567        };
568        assert!(expected);
569    }
570
571    #[cfg(feature = "arbitrary")]
572    mod conformance {
573        use super::*;
574        use commonware_codec::conformance::CodecConformance;
575
576        commonware_conformance::conformance_tests! {
577            CodecConformance<Signature> => 1024,
578        }
579    }
580}
commonware_cryptography/secp256r1/standard.rs

commonware_cryptography/secp256r1/
standard.rs
