Skip to content

Commit e29595f

Browse files
ret2libcret2libc
authored
Use different hash in proof of possession based on key (#1959)
Signed-off-by: Riccardo Schirone <[email protected]>
1 parent cfef330 commit e29595f

File tree

6 files changed

+162
-92
lines changed

6 files changed

+162
-92
lines changed

‎go.mod‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ require (
1616
github.com/go-jose/go-jose/v4 v4.0.5
1717
github.com/goadesign/goa v2.2.5+incompatible
1818
github.com/google/certificate-transparency-go v1.3.1
19-
github.com/google/go-cmp v0.6.0
19+
github.com/google/go-cmp v0.7.0
2020
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
2121
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99
2222
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.0
@@ -27,7 +27,7 @@ require (
2727
github.com/prometheus/common v0.62.0
2828
github.com/rs/cors v1.11.1
2929
github.com/sigstore/protobuf-specs v0.4.0
30-
github.com/sigstore/sigstore v1.8.13-0.20250204232249-4b62818325b7
30+
github.com/sigstore/sigstore v1.9.1-0.20250310170251-f577ba06d54c
3131
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12
3232
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.12
3333
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.12
@@ -45,7 +45,7 @@ require (
4545
google.golang.org/api v0.218.0
4646
google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f
4747
google.golang.org/grpc v1.70.0
48-
google.golang.org/protobuf v1.36.4
48+
google.golang.org/protobuf v1.36.5
4949
gopkg.in/yaml.v3 v3.0.1
5050
sigs.k8s.io/release-utils v0.9.0
5151
)
@@ -97,7 +97,7 @@ require (
9797
github.com/go-logr/stdr v1.2.2 // indirect
9898
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
9999
github.com/golang/protobuf v1.5.4 // indirect
100-
github.com/google/go-containerregistry v0.20.2 // indirect
100+
github.com/google/go-containerregistry v0.20.3 // indirect
101101
github.com/google/s2a-go v0.1.9 // indirect
102102
github.com/google/uuid v1.6.0 // indirect
103103
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
@@ -144,21 +144,22 @@ require (
144144
github.com/subosito/gotenv v1.6.0 // indirect
145145
github.com/thales-e-security/pool v0.0.2 // indirect
146146
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
147+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
147148
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0 // indirect
148-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
149-
go.opentelemetry.io/otel v1.32.0 // indirect
149+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
150+
go.opentelemetry.io/otel v1.33.0 // indirect
150151
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 // indirect
151152
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 // indirect
152-
go.opentelemetry.io/otel/metric v1.32.0 // indirect
153-
go.opentelemetry.io/otel/sdk v1.32.0 // indirect
154-
go.opentelemetry.io/otel/trace v1.32.0 // indirect
153+
go.opentelemetry.io/otel/metric v1.33.0 // indirect
154+
go.opentelemetry.io/otel/sdk v1.33.0 // indirect
155+
go.opentelemetry.io/otel/trace v1.33.0 // indirect
155156
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
156157
go.uber.org/multierr v1.11.0 // indirect
157158
goa.design/goa v2.2.5+incompatible // indirect
158-
golang.org/x/crypto v0.33.0 // indirect
159+
golang.org/x/crypto v0.35.0 // indirect
159160
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
160161
golang.org/x/net v0.35.0 // indirect
161-
golang.org/x/oauth2 v0.25.0 // indirect
162+
golang.org/x/oauth2 v0.27.0 // indirect
162163
golang.org/x/sync v0.11.0 // indirect
163164
golang.org/x/sys v0.30.0 // indirect
164165
golang.org/x/term v0.29.0 // indirect

‎go.sum‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -159,10 +159,10 @@ github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeW
159159
github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
160160
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
161161
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
162-
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
163-
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
164-
github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
165-
github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
162+
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
163+
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
164+
github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
165+
github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
166166
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
167167
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
168168
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -309,8 +309,8 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
309309
github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
310310
github.com/sigstore/protobuf-specs v0.4.0 h1:yoZbdh0kZYKOSiVbYyA8J3f2wLh5aUk2SQB7LgAfIdU=
311311
github.com/sigstore/protobuf-specs v0.4.0/go.mod h1:FKW5NYhnnFQ/Vb9RKtQk91iYd0MKJ9AxyqInEwU6+OI=
312-
github.com/sigstore/sigstore v1.8.13-0.20250204232249-4b62818325b7 h1:dKgngAj90pDWGKB/yBt/AmSvNFzLOPvYGfEgEKRQWc4=
313-
github.com/sigstore/sigstore v1.8.13-0.20250204232249-4b62818325b7/go.mod h1:2lXojNsjZjkqu1//FWxq7qUcPB8Lq1KsR5hc+GkcC/4=
312+
github.com/sigstore/sigstore v1.9.1-0.20250310170251-f577ba06d54c h1:BsBhjVq3VPVNTCV5FQSnwzvwJuCYtkIbUHmz4pmGrZY=
313+
github.com/sigstore/sigstore v1.9.1-0.20250310170251-f577ba06d54c/go.mod h1:zUoATYzR1J3rLNp3jmp4fzIJtWdhC3ZM6MnpcBtnsE4=
314314
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12 h1:EC3UmIaa7nV9sCgSpVevmvgvTYTkMqyrRbj5ojPp7tE=
315315
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12/go.mod h1:aw60vs3crnQdM/DYH+yF2P0MVKtItwAX34nuaMrY7Lk=
316316
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.12 h1:FPpliDTywSy0woLHMAdmTSZ5IS/lVBZ0dY0I+2HmnSY=
@@ -380,24 +380,26 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
380380
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
381381
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
382382
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
383+
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
384+
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
383385
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0 h1:qtFISDHKolvIxzSs0gIaiPUPR0Cucb0F2coHC7ZLdps=
384386
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0/go.mod h1:Y+Pop1Q6hCOnETWTW4NROK/q1hv50hM7yDaUTjG8lp8=
385-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 h1:DheMAlT6POBP+gh8RUH19EOTnQIor5QE0uSRPtzCpSw=
386-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0/go.mod h1:wZcGmeVO9nzP67aYSLDqXNWK87EZWhi7JWj1v7ZXf94=
387-
go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
388-
go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
387+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
388+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
389+
go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
390+
go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
389391
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0 h1:IJFEoHiytixx8cMiVAO+GmHR6Frwu+u5Ur8njpFO6Ac=
390392
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0/go.mod h1:3rHrKNtLIoS0oZwkY2vxi+oJcwFRWdtUyRII+so45p8=
391393
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0 h1:9kV11HXBHZAvuPUZxmMWrH8hZn/6UnHX4K0mu36vNsU=
392394
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0/go.mod h1:JyA0FHXe22E1NeNiHmVp7kFHglnexDQ7uRWDiiJ1hKQ=
393-
go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
394-
go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
395-
go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
396-
go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
395+
go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
396+
go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
397+
go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
398+
go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
397399
go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
398400
go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
399-
go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
400-
go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
401+
go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
402+
go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
401403
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
402404
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
403405
go.step.sm/crypto v0.57.0 h1:YjoRQDaJYAxHLVwjst0Bl0xcnoKzVwuHCJtEo2VSHYU=
@@ -419,8 +421,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
419421
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
420422
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
421423
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
422-
golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
423-
golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
424+
golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
425+
golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
424426
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
425427
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
426428
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
@@ -448,8 +450,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
448450
golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
449451
golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
450452
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
451-
golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
452-
golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
453+
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
454+
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
453455
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
454456
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
455457
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -530,8 +532,8 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
530532
google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
531533
google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
532534
google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
533-
google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
534-
google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
535+
google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
536+
google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
535537
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
536538
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
537539
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

‎pkg/challenges/challenges.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,17 @@ import (
4444
// CheckSignature verifies a challenge, a signature over the subject or email
4545
// of an OIDC token
4646
func CheckSignature(pub crypto.PublicKey, proof []byte, subject string) error {
47-
verifier, err := signature.LoadVerifier(pub, crypto.SHA256)
47+
verifier, err := signature.LoadDefaultVerifier(pub)
4848
if err != nil {
4949
return err
5050
}
5151

52+
return CheckSignatureWithVerifier(verifier, proof, subject)
53+
}
54+
55+
// CheckSignatureWithVerifier verifies a challenge, a signature over the subject
56+
// or email of an OIDC token
57+
func CheckSignatureWithVerifier(verifier signature.Verifier, proof []byte, subject string) error {
5258
return verifier.VerifySignature(bytes.NewReader(proof), strings.NewReader(subject))
5359
}
5460

‎pkg/challenges/challenges_test.go‎

Lines changed: 105 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,15 @@ package challenges
1818
import (
1919
"crypto"
2020
"crypto/ecdsa"
21+
"crypto/ed25519"
2122
"crypto/elliptic"
2223
"crypto/rand"
2324
"crypto/rsa"
24-
"crypto/sha256"
25+
"strings"
2526
"testing"
2627

2728
"github.com/sigstore/sigstore/pkg/cryptoutils"
29+
"github.com/sigstore/sigstore/pkg/signature"
2830
)
2931

3032
func failErr(t *testing.T, err error) {
@@ -33,55 +35,110 @@ func failErr(t *testing.T, err error) {
3335
}
3436
}
3537

36-
func TestCheckSignatureECDSA(t *testing.T) {
37-
38-
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
39-
failErr(t, err)
40-
41-
email := "[email protected]"
42-
if err := CheckSignature(&priv.PublicKey, []byte("foo"), email); err == nil {
43-
t.Fatal("check should have failed")
44-
}
45-
46-
h := sha256.Sum256([]byte(email))
47-
signature, err := priv.Sign(rand.Reader, h[:], crypto.SHA256)
48-
failErr(t, err)
49-
50-
if err := CheckSignature(&priv.PublicKey, signature, email); err != nil {
51-
t.Fatal(err)
52-
}
53-
54-
// Nil key should fail
55-
if err := CheckSignature(nil, signature, email); err == nil {
56-
t.Error("nil public key should raise error")
57-
}
58-
59-
// Try a bad email but "good" signature
60-
if err := CheckSignature(&priv.PublicKey, signature, "[email protected]"); err == nil {
61-
t.Fatal("check should have failed")
62-
}
63-
}
64-
65-
func TestCheckSignatureRSA(t *testing.T) {
66-
priv, err := rsa.GenerateKey(rand.Reader, 2048)
67-
failErr(t, err)
68-
69-
email := "[email protected]"
70-
if err := CheckSignature(&priv.PublicKey, []byte("foo"), email); err == nil {
71-
t.Fatal("check should have failed")
72-
}
73-
74-
h := sha256.Sum256([]byte(email))
75-
signature, err := priv.Sign(rand.Reader, h[:], crypto.SHA256)
76-
failErr(t, err)
77-
78-
if err := CheckSignature(&priv.PublicKey, signature, email); err != nil {
79-
t.Fatal(err)
38+
func TestCheckSignature(t *testing.T) {
39+
tts := []struct {
40+
name string
41+
keys func() (crypto.PublicKey, crypto.PrivateKey)
42+
hashFunc crypto.Hash
43+
signHashFunc crypto.Hash
44+
}{
45+
{
46+
name: "ecdsa-p256",
47+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
48+
priv, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
49+
return priv.Public(), priv
50+
},
51+
hashFunc: crypto.SHA256,
52+
signHashFunc: crypto.SHA256,
53+
},
54+
{
55+
name: "ecdsa-p384",
56+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
57+
priv, _ := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
58+
return priv.Public(), priv
59+
},
60+
hashFunc: crypto.SHA384,
61+
signHashFunc: crypto.SHA384,
62+
},
63+
{
64+
name: "ecdsa-p521",
65+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
66+
priv, _ := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
67+
return priv.Public(), priv
68+
},
69+
hashFunc: crypto.SHA512,
70+
signHashFunc: crypto.SHA512,
71+
},
72+
{
73+
name: "rsa-2048",
74+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
75+
priv, _ := rsa.GenerateKey(rand.Reader, 2048)
76+
return priv.Public(), priv
77+
},
78+
hashFunc: crypto.SHA256,
79+
signHashFunc: crypto.SHA256,
80+
},
81+
{
82+
name: "rsa-3072",
83+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
84+
priv, _ := rsa.GenerateKey(rand.Reader, 3072)
85+
return priv.Public(), priv
86+
},
87+
hashFunc: crypto.SHA256,
88+
signHashFunc: crypto.SHA256,
89+
},
90+
{
91+
name: "rsa-4096",
92+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
93+
priv, _ := rsa.GenerateKey(rand.Reader, 4096)
94+
return priv.Public(), priv
95+
},
96+
hashFunc: crypto.SHA256,
97+
signHashFunc: crypto.SHA256,
98+
},
99+
{
100+
name: "ed25519",
101+
keys: func() (crypto.PublicKey, crypto.PrivateKey) {
102+
pub, priv, _ := ed25519.GenerateKey(rand.Reader)
103+
return pub, priv
104+
},
105+
hashFunc: crypto.SHA512,
106+
signHashFunc: crypto.Hash(0),
107+
},
80108
}
81109

82-
// Try a bad email but "good" signature
83-
if err := CheckSignature(&priv.PublicKey, signature, "[email protected]"); err == nil {
84-
t.Fatal("check should have failed")
110+
for _, tt := range tts {
111+
t.Run(tt.name, func(t *testing.T) {
112+
pub, priv := tt.keys()
113+
114+
email := "[email protected]"
115+
if err := CheckSignature(pub, []byte("foo"), email); err == nil {
116+
t.Fatal("check should have failed")
117+
}
118+
119+
signerVerifier, err := signature.LoadSignerVerifier(priv, tt.signHashFunc)
120+
failErr(t, err)
121+
122+
signature, err := signerVerifier.SignMessage(strings.NewReader(email))
123+
failErr(t, err)
124+
125+
if err := CheckSignatureWithVerifier(signerVerifier, signature, email); err != nil {
126+
t.Fatal(err)
127+
}
128+
if err := CheckSignature(pub, signature, email); err != nil {
129+
t.Fatal(err)
130+
}
131+
132+
// Nil key should fail
133+
if err := CheckSignature(nil, signature, email); err == nil {
134+
t.Error("nil public key should raise error")
135+
}
136+
137+
// Try a bad email but "good" signature
138+
if err := CheckSignature(pub, signature, "[email protected]"); err == nil {
139+
t.Fatal("check should have failed")
140+
}
141+
})
85142
}
86143
}
87144

‎pkg/server/grpc_server.go‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ package server
1818
import (
1919
"context"
2020
"crypto"
21-
"crypto/ed25519"
2221
"crypto/x509"
2322
"encoding/json"
2423
"errors"
@@ -141,15 +140,20 @@ func (g *grpcaCAServer) CreateSigningCertificate(ctx context.Context, request *f
141140
return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, insecurePublicKey)
142141
}
143142

144-
// Check proof of possession signature
145-
if err := challenges.CheckSignature(publicKey, proofOfPossession, principal.Name(ctx)); err != nil {
146-
return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, invalidSignature)
143+
proofOfPossessionAlgo, err := signature.GetDefaultAlgorithmDetails(publicKey)
144+
if err != nil {
145+
return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
147146
}
147+
verifier, err := signature.LoadDefaultVerifier(publicKey)
148+
if err != nil {
149+
return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, err.Error())
150+
}
151+
// TODO: Ideally this comes from the verifier
152+
hashFunc = proofOfPossessionAlgo.GetHashType()
148153

149-
// The proof of possession signature always uses SHA-256, unless the key algorithm is ED25519
150-
hashFunc = crypto.SHA256
151-
if _, ok := publicKey.(ed25519.PublicKey); ok {
152-
hashFunc = crypto.Hash(0)
154+
// Check proof of possession signature
155+
if err := challenges.CheckSignatureWithVerifier(verifier, proofOfPossession, principal.Name(ctx)); err != nil {
156+
return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, invalidSignature)
153157
}
154158
}
155159

0 commit comments

Comments
 (0)