When running the following code with the Python3 <a href="https://cryptography.io/en/l

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

P256 ECDSA Signing does not match other implementations about elliptic-curves HOT 2 CLOSED

rustcrypto commented on July 22, 2024

P256 ECDSA Signing does not match other implementations

from elliptic-curves.

Comments (2)

tarcieri commented on July 22, 2024 1

@alistair23 please reopen if you think there’s still an issue

from elliptic-curves.

tarcieri commented on July 22, 2024

Note that the implementation in the p256 crate passes this test vector from RFC6979:

https://tools.ietf.org/html/rfc6979#appendix-A.2.5

curve: NIST P-256
private key:
   x = C9AFA9D845BA75166B5C215767B1D6934E50C3DB36E89B127B8A622B120F6721

With SHA-256, message = "sample":
   k = A6E3C57DD01ABE90086538398355DD4C3B17AA873382B0F24D6129493D8AAD60
   r = EFD48B2AACB6A8FD1140DD9CD45E81D69D2C877B56AAF991C34D0EA84EAF3716
   s = F7CB1C942D657C41D436C7A1B6E29F65F3E900DBB9AFF4064DC4AB2F843ACDA8

You can find the test for this vector against the p256 implementation here:

https://github.com/RustCrypto/elliptic-curves/blob/cf65586/p256/src/ecdsa.rs#L146-L158

The signature from Python cryptography does not match this test vector:

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec, utils
from cryptography.hazmat.primitives import hashes
attest = ec.derive_private_key(0xc9afa9d845ba75166b5c215767b1d6934e50c3db36e89b127b8a622b120f6721, ec.SECP256R1(), default_backend())
data = bytes([115, 97, 109, 112, 108, 101])
sig = attest.sign(data, ec.ECDSA(hashes.SHA256()))
output = utils.decode_dss_signature(sig)
print("Signature: r: " + str(hex(output[0])) + " s: " + str(hex(output[1])))

Prints:

r: 0xcfed9cfefbd61caf24b3d04f56c94c215af3597be11d27cd646786bb5360512c
s: 0x295c05ecf488ac7df05ca71bd332f868a663793aa749b622f470cc401b5f0b0f

(it's possible I adapted the example incorrectly, please double check me on that)

ECDSA signing implementations are free to choose k as they please. You might want to check if cryptography implements RFC6979. Whatever they're doing appears to be deterministic, but may not necessarily match RFC6979.

from elliptic-curves.

Recommend Projects