crypto/ecdsa: implement deterministic and hedged signatures

For the future, some test vectors we should generate and then share
through Wycheproof or CCTV:
 - A private key with a leading zero byte.
 - A hash longer than the modulus.
 - A hash longer than the P-521 modulus by a few bits.
 - Reductions happening in hashToNat and bits2octets.

Fixes #64802

Change-Id: Ia0f89781b2c78eedd5103cf0e9720630711c37ad
Reviewed-on: https://go-review.googlesource.com/c/go/+/628681
TryBot-Bypass: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda 2024-11-16 23:45:05 +01:00 committed by Gopher Robot
parent 0eeabaa9d7
commit 548fd92733
8 changed files with 429 additions and 429 deletions

View file

@ -17,11 +17,11 @@
000000f0 bb 29 07 30 ff f6 84 af c4 cf c2 ed 90 99 5f 58 |.).0.........._X|
00000100 cb 3b 74 |.;t|
>>> Flow 2 (server to client)
00000000 16 03 01 00 5d 02 00 00 59 03 01 48 c6 a1 aa 01 |....]...Y..H....|
00000010 b8 4b a1 f5 6d 71 28 f7 fd 76 9d 12 50 d3 56 e2 |.K..mq(..v..P.V.|
00000020 ca 77 d4 82 07 65 e2 c5 12 40 35 20 e3 ee 0a df |.w...e...@5 ....|
00000030 1f 4a d9 b3 a6 6f a0 24 49 8d ab d9 d8 3c 24 36 |.J...o.$I....<$6|
00000040 35 ba 64 8b 7d ec 29 91 d9 26 5e 61 c0 13 00 00 |5.d.}.)..&^a....|
00000000 16 03 01 00 5d 02 00 00 59 03 01 0b 4b bc a9 e8 |....]...Y...K...|
00000010 4a 08 69 de 73 f8 fc 53 c6 e9 cd cf 25 7a 5f b6 |J.i.s..S....%z_.|
00000020 60 48 65 3e f5 5f 9f 14 e7 38 a0 20 ec fe 94 b2 |`He>._...8. ....|
00000030 6d a9 d7 91 c4 92 6b 3e a4 2e 88 72 07 c3 47 12 |m.....k>...r..G.|
00000040 78 cc 45 86 f9 56 16 f9 d7 d9 38 c2 c0 13 00 00 |x.E..V....8.....|
00000050 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 |................|
00000060 00 00 16 03 01 02 59 0b 00 02 55 00 02 52 00 02 |......Y...U..R..|
00000070 4f 30 82 02 4b 30 82 01 b4 a0 03 02 01 02 02 09 |O0..K0..........|
@ -61,17 +61,17 @@
00000290 73 bb b3 43 77 8d 0c 1c f1 0f a1 d8 40 83 61 c9 |s..Cw.......@.a.|
000002a0 4c 72 2b 9d ae db 46 06 06 4d f4 c1 b3 3e c0 d1 |Lr+...F..M...>..|
000002b0 bd 42 d4 db fe 3d 13 60 84 5c 21 d3 3b e9 fa e7 |.B...=.`.\!.;...|
000002c0 16 03 01 00 aa 0c 00 00 a6 03 00 1d 20 55 51 65 |............ UQe|
000002d0 bb 06 22 d7 d6 97 39 d1 f4 dc 95 06 b3 a4 a7 00 |.."...9.........|
000002e0 d1 e5 98 bc 97 12 03 25 03 12 ab 20 4f 00 80 71 |.......%... O..q|
000002f0 8d 3c 54 44 ba df 73 92 76 16 d1 ec b1 de a2 27 |.<TD..s.v......'|
00000300 97 b1 e9 31 37 ea a7 5d a9 00 ce 85 08 5a b3 ac |...17..].....Z..|
00000310 ef a6 8d c3 9f a5 ba 97 e8 bc 9f 81 63 77 7b 2e |............cw{.|
00000320 92 5f 36 a1 00 04 c1 3f e9 76 bb 58 da aa 03 ba |._6....?.v.X....|
00000330 cd 11 9b 9a 56 2e 64 53 74 b4 62 00 89 4a 57 0f |....V.dSt.b..JW.|
00000340 a2 a9 f2 16 17 ab a3 72 3d 16 4d 41 4a df 54 b1 |.......r=.MAJ.T.|
00000350 72 ab 8b bf a3 74 af 1c 30 d0 75 27 a6 ce a1 56 |r....t..0.u'...V|
00000360 ec 08 f9 c0 c9 9d 71 7a 83 a4 bd 33 af 7a 5e 16 |......qz...3.z^.|
000002c0 16 03 01 00 aa 0c 00 00 a6 03 00 1d 20 fc 77 2f |............ .w/|
000002d0 88 9a a9 71 3a 14 bf 27 27 40 e0 28 ce e8 e8 3b |...q:..''@.(...;|
000002e0 cd 0a 43 21 75 c9 93 70 9a 22 f1 ec 3a 00 80 d2 |..C!u..p."..:...|
000002f0 cd 71 ae f6 d8 54 5c f3 a4 da c7 64 51 b8 36 b8 |.q...T\....dQ.6.|
00000300 46 d5 8c b1 a0 43 9b f2 b5 2c 12 89 08 39 2b c3 |F....C...,...9+.|
00000310 79 4e 5d 3d 7e 7f d5 51 c3 c5 1e 9e 3b 7c 39 c4 |yN]=~..Q....;|9.|
00000320 c3 64 52 91 94 2f 2c ee aa 7c 0e ed fd 7a 65 bb |.dR../,..|...ze.|
00000330 5a 62 f4 45 24 3d e7 e3 f2 8a 72 74 a7 9d f2 d5 |Zb.E$=....rt....|
00000340 69 be dc 6e 23 fb 68 bb 6e 64 9e 43 a8 f4 08 2b |i..n#.h.nd.C...+|
00000350 86 be ea 88 40 13 5f 3f 0b 18 74 e3 43 76 be 98 |....@._?..t.Cv..|
00000360 b8 15 ea 4d cb 6e 23 3c 8b a9 ce d4 6a e3 13 16 |...M.n#<....j...|
00000370 03 01 00 0a 0d 00 00 06 03 01 02 40 00 00 16 03 |...........@....|
00000380 01 00 04 0e 00 00 00 |.......|
>>> Flow 3 (client to server)
@ -111,29 +111,29 @@
00000210 03 01 00 25 10 00 00 21 20 2f e5 7d a3 47 cd 62 |...%...! /.}.G.b|
00000220 43 15 28 da ac 5f bb 29 07 30 ff f6 84 af c4 cf |C.(.._.).0......|
00000230 c2 ed 90 99 5f 58 cb 3b 74 16 03 01 00 90 0f 00 |...._X.;t.......|
00000240 00 8c 00 8a 30 81 87 02 41 79 c5 57 74 46 9a 18 |....0...Ay.WtF..|
00000250 ad e0 b0 ba 68 f5 0e e2 58 94 dc 73 84 5a f8 86 |....h...X..s.Z..|
00000260 86 8e 2a 37 82 02 a1 4b 19 cd 71 b3 99 04 64 b0 |..*7...K..q...d.|
00000270 db 4a cc 41 a6 17 28 38 f1 67 bd 59 16 97 71 32 |.J.A..(8.g.Y..q2|
00000280 06 71 24 2c f3 df 34 1b a3 b8 02 42 01 2f 2f db |.q$,..4....B.//.|
00000290 45 07 94 53 89 81 59 0b 92 9d 1a 05 42 b3 1c 40 |E..S..Y.....B..@|
000002a0 38 50 a1 8e a6 35 15 76 ca 75 7e fc 8d 7b 36 f3 |8P...5.v.u~..{6.|
000002b0 e3 e7 bf f9 bd 94 35 a0 c5 2b 35 88 be 5d ee f1 |......5..+5..]..|
000002c0 00 f9 9c a8 01 a8 92 5d d6 17 b6 54 98 e4 14 03 |.......]...T....|
000002d0 01 00 01 01 16 03 01 00 30 1f d6 11 ac 58 b3 20 |........0....X. |
000002e0 31 6d 3b f5 83 98 50 75 ff 4f 79 61 2b fc 0f 6c |1m;...Pu.Oya+..l|
000002f0 a6 4d 9e 65 38 e3 ca 12 76 0a 56 1e dd 73 da e1 |.M.e8...v.V..s..|
00000300 66 5a 33 62 8f 7d c3 ed ad |fZ3b.}...|
00000240 00 8c 00 8a 30 81 87 02 41 2c f8 d2 c2 28 75 28 |....0...A,...(u(|
00000250 67 de 75 fb 7a 09 20 8a ec 06 a6 42 03 ad 3c 95 |g.u.z. ....B..<.|
00000260 bb 00 f6 10 71 c7 90 fe 08 16 fa ed 7d 71 24 a2 |....q.......}q$.|
00000270 b6 76 ce f9 1b ff a9 ff 05 b6 dd d8 63 2b 74 86 |.v..........c+t.|
00000280 65 f5 ef f7 36 41 47 77 b5 88 02 42 00 8a 80 f8 |e...6AGw...B....|
00000290 9b cf de a6 b7 c3 d8 48 a1 a0 47 7e cf 33 fc f7 |.......H..G~.3..|
000002a0 fc 87 40 cf 8d c3 81 85 c7 19 9e 37 9e 54 f7 3e |..@........7.T.>|
000002b0 d1 1c 42 83 21 d7 2e ae 02 7b 3c ce 97 f3 9b a0 |..B.!....{<.....|
000002c0 a3 4e b9 a0 9c 78 f0 7e 9c 96 fc 78 e6 08 14 03 |.N...x.~...x....|
000002d0 01 00 01 01 16 03 01 00 30 84 a0 4f 8d 01 40 ca |........0..O..@.|
000002e0 c0 fd ea 1a 9c df 27 cc 25 00 56 e2 30 05 c0 d9 |......'.%.V.0...|
000002f0 c7 21 48 37 6b 35 c3 a4 4e bf 67 98 87 78 0f 3c |.!H7k5..N.g..x.<|
00000300 74 72 4f 6a c5 0d fd 0c 84 |trOj.....|
>>> Flow 4 (server to client)
00000000 14 03 01 00 01 01 16 03 01 00 30 92 36 25 46 a5 |..........0.6%F.|
00000010 44 e6 31 25 cd 24 15 df 13 f8 5b a3 af 7c 12 43 |D.1%.$....[..|.C|
00000020 b8 8c 39 84 bc 25 06 02 02 86 78 20 1b ec 98 1a |..9..%....x ....|
00000030 31 b3 b8 cf 82 92 77 ff 08 87 fb |1.....w....|
00000000 14 03 01 00 01 01 16 03 01 00 30 01 da 6e 2a 83 |..........0..n*.|
00000010 20 ad 52 16 f2 c6 c1 55 b8 77 0d 5f c6 48 dc e7 | .R....U.w._.H..|
00000020 72 29 88 0a 2b 1a d1 1e fd fb c0 c3 18 c8 43 47 |r)..+.........CG|
00000030 a9 8f d3 fe f3 d8 d2 a8 ce 79 44 |.........yD|
>>> Flow 5 (client to server)
00000000 17 03 01 00 20 2f bd ab e0 2f 9a 81 58 99 35 bb |.... /.../..X.5.|
00000010 86 61 6e 15 be 31 d7 ad 44 1d d9 cf 2f fc d9 f6 |.an..1..D.../...|
00000020 da b6 48 32 27 17 03 01 00 20 76 70 b7 7d 1b 05 |..H2'.... vp.}..|
00000030 ee 54 99 bf 89 79 79 b5 68 c1 84 3c 6d 47 5c d1 |.T...yy.h..<mG\.|
00000040 a6 a1 81 65 e6 e9 b1 05 e0 45 15 03 01 00 20 4e |...e.....E.... N|
00000050 92 00 b5 bc b9 b8 c6 fe d1 5c d1 93 f8 cd 7c 3f |.........\....|?|
00000060 bd 47 82 ff b0 00 3b 96 f0 7a 3b a4 cc 15 f3 |.G....;..z;....|
00000000 17 03 01 00 20 e5 74 9a b9 0b 6c 43 0f 4e db e4 |.... .t...lC.N..|
00000010 ba 10 5d 9a f0 96 16 17 ad a5 42 d8 0d a3 39 86 |..].......B...9.|
00000020 6c f0 8a 64 70 17 03 01 00 20 d2 11 27 ea f2 80 |l..dp.... ..'...|
00000030 a5 5d ba 7b 99 4b 94 25 13 24 29 05 7b 64 00 51 |.].{.K.%.$).{d.Q|
00000040 14 8e d5 e9 e2 c0 5d 98 96 30 15 03 01 00 20 7e |......]..0.... ~|
00000050 87 d2 6c 5c b5 1c 11 72 e1 c4 e5 e0 f3 16 6b db |..l\...r......k.|
00000060 55 c3 c7 ae a9 38 d3 07 04 41 be c5 42 43 a4 |U....8...A..BC.|