From 7a9cd52f61c1870c489221be777624a4a7468d1e Mon Sep 17 00:00:00 2001 From: Dominik Roos Date: Fri, 26 Mar 2021 20:52:56 +0100 Subject: [PATCH 1/4] certutil: select appropriate hash algorithm for ECDSA signature Select the appropriate signature algorithm for certificates signed with an ECDSA private key. The algorithm is selected based on the curve: - P-256 -> x509.ECDSAWithSHA256 - P-384 -> x509.ECDSAWithSHA384 - P-521 -> x509.ECDSAWithSHA512 - Other -> x509.ECDSAWithSHA256 fixes #11006 --- sdk/helper/certutil/helpers.go | 45 ++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 16 deletions(-) diff --git a/sdk/helper/certutil/helpers.go b/sdk/helper/certutil/helpers.go index e8edcfd2913f7..96ed514739021 100644 --- a/sdk/helper/certutil/helpers.go +++ b/sdk/helper/certutil/helpers.go @@ -655,14 +655,7 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB case Ed25519PrivateKey: certTemplate.SignatureAlgorithm = x509.PureEd25519 case ECPrivateKey: - switch data.Params.SignatureBits { - case 256: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256 - case 384: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA384 - case 512: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA512 - } + certTemplate.SignatureAlgorithm = selectSignatureAlgorithmForECDSA(data.SigningBundle.PrivateKey.Public(), data.Params.SignatureBits) } caCert := data.SigningBundle.Certificate @@ -691,14 +684,7 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB case "ed25519": certTemplate.SignatureAlgorithm = x509.PureEd25519 case "ec": - switch data.Params.SignatureBits { - case 256: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256 - case 384: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA384 - case 512: - certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA512 - } + certTemplate.SignatureAlgorithm = selectSignatureAlgorithmForECDSA(data.SigningBundle.PrivateKey.Public(), data.Params.SignatureBits) } certTemplate.AuthorityKeyId = subjKeyID @@ -733,6 +719,33 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB return result, nil } +func selectSignatureAlgorithmForECDSA(pub crypto.PublicKey, signatureBits int) x509.SignatureAlgorithm { + // If signature bits are configured, prefer them to the default choice. + switch signatureBits { + case 256: + return x509.ECDSAWithSHA256 + case 384: + return x509.ECDSAWithSHA384 + case 512: + return x509.ECDSAWithSHA512 + } + + key, ok := pub.(*ecdsa.PublicKey) + if !ok { + return x509.ECDSAWithSHA256 + } + switch key.Curve { + case elliptic.P224(), elliptic.P256(): + return x509.ECDSAWithSHA256 + case elliptic.P384(): + return x509.ECDSAWithSHA384 + case elliptic.P521(): + return x509.ECDSAWithSHA512 + default: + return x509.ECDSAWithSHA256 + } +} + var oidExtensionBasicConstraints = []int{2, 5, 29, 19} // CreateCSR creates a CSR with the default rand.Reader to From 65394891c6b395321b9242d6908ea7cecf17a11b Mon Sep 17 00:00:00 2001 From: Dominik Roos Date: Wed, 3 Nov 2021 21:35:07 +0100 Subject: [PATCH 2/4] fix panic --- sdk/helper/certutil/helpers.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/helper/certutil/helpers.go b/sdk/helper/certutil/helpers.go index 96ed514739021..4ce36b6d6dc7d 100644 --- a/sdk/helper/certutil/helpers.go +++ b/sdk/helper/certutil/helpers.go @@ -684,7 +684,7 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB case "ed25519": certTemplate.SignatureAlgorithm = x509.PureEd25519 case "ec": - certTemplate.SignatureAlgorithm = selectSignatureAlgorithmForECDSA(data.SigningBundle.PrivateKey.Public(), data.Params.SignatureBits) + certTemplate.SignatureAlgorithm = selectSignatureAlgorithmForECDSA(result.PrivateKey.Public(), data.Params.SignatureBits) } certTemplate.AuthorityKeyId = subjKeyID From a76ca83e0556053aed16ba31a17779a7d83de34e Mon Sep 17 00:00:00 2001 From: Dominik Roos Date: Wed, 3 Nov 2021 22:37:05 +0100 Subject: [PATCH 3/4] add changelog --- changelog/11216.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changelog/11216.txt diff --git a/changelog/11216.txt b/changelog/11216.txt new file mode 100644 index 0000000000000..ec44cc969e159 --- /dev/null +++ b/changelog/11216.txt @@ -0,0 +1,3 @@ +```release-note:improvement +helper/certutil: select appropriate signature algorithm for ECDSA signature on certificates. +``` From 627280db2f27f22defb54580acf91c3d23ad28ff Mon Sep 17 00:00:00 2001 From: Victor Rodriguez Date: Thu, 4 Nov 2021 11:28:49 -0400 Subject: [PATCH 4/4] Tweak changelog. --- changelog/11216.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog/11216.txt b/changelog/11216.txt index ec44cc969e159..beef5c5d44dc1 100644 --- a/changelog/11216.txt +++ b/changelog/11216.txt @@ -1,3 +1,3 @@ ```release-note:improvement -helper/certutil: select appropriate signature algorithm for ECDSA signature on certificates. +secrets/pki: select appropriate signature algorithm for ECDSA signature on certificates. ```