Add ECDSA key support (SECP256R1) again #108

itstheceo · 2024-11-26T18:29:59Z

Supersedes #101

Had some difficulties syncing latest on the other PR, because the fork got disconnected from upstream when my organisation did a bulk visibility change across all repositories. Have just done in my personal account, same branch as before but synced with upstream.

Uses BouncyCastle for the provider. Any feedback greatly appreciated. Thanks!

I also have a follow up PR for adding remote signing capabilities, for when the private key is not directly accessible. I'll open that later, once these changes (hopefully) get accepted 🤞 . I understand you have other implementations to coordinate so no rush.

just want to get plumbed in and existing tests passing

…ng verify

sync upstream

…cuit#4) This implements 3rd party block generation and appending to existing tokens. It also fixes existing issues with public key interning which made deserialization of tokens with 3rd party blocks incorrect in some cases. Co-authored-by: Geoffroy Couprie <contact@geoffroycouprie.com>

# Conflicts: # src/main/java/org/biscuitsec/biscuit/crypto/KeyPair.java # src/main/java/org/biscuitsec/biscuit/crypto/PublicKey.java # src/main/java/org/biscuitsec/biscuit/token/Biscuit.java # src/main/java/org/biscuitsec/biscuit/token/UnverifiedBiscuit.java # src/main/java/org/biscuitsec/biscuit/token/builder/parser/Parser.java # src/main/java/org/biscuitsec/biscuit/token/format/SerializedBiscuit.java # src/test/java/org/biscuitsec/biscuit/token/BiscuitTest.java

Implement 3rd party block creation (eclipse-biscuit#104)

# Conflicts: # src/main/java/org/biscuitsec/biscuit/token/UnverifiedBiscuit.java

Korbik

I will try to use the sample from the new specification

src/main/java/org/biscuitsec/biscuit/crypto/Ed25519KeyPair.java

Korbik · 2025-01-15T08:21:37Z

pom.xml

+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk18on</artifactId>
+            <version>1.78.1</version>


Suggested change

<version>1.78.1</version>

<version>1.79</version>

Do we bump the version of Bouncy ?

Korbik · 2025-01-15T08:52:20Z

src/main/java/org/biscuitsec/biscuit/crypto/SECP256R1KeyPair.java

+import java.security.Security;
+import java.security.Signature;
+
+class SECP256R1KeyPair extends KeyPair {


Suggested change

class SECP256R1KeyPair extends KeyPair {

final class SECP256R1KeyPair extends KeyPair {

Korbik · 2025-01-15T09:05:49Z

src/main/java/org/biscuitsec/biscuit/token/format/SerializedBiscuit.java

-            return Either.left(new Error.FormatError.Signature.InvalidSignatureSize(signature.length));
+
+        if (publicKey.algorithm == Schema.PublicKey.Algorithm.Ed25519) {
+            if (signature.length != 64) {


Could be an improvement to replace it by a constant.

Korbik · 2025-01-15T09:06:01Z

src/main/java/org/biscuitsec/biscuit/token/format/SerializedBiscuit.java

+                return Either.left(new Error.FormatError.Signature.InvalidSignatureSize(signature.length));
+            }
+        } else if (publicKey.algorithm == Schema.PublicKey.Algorithm.SECP256R1) {
+            if (signature.length < 68 || signature.length > 72) {


Could be an improvement to replace it by a constant.

Korbik · 2025-01-15T09:08:09Z

src/main/java/org/biscuitsec/biscuit/token/UnverifiedBiscuit.java

@@ -335,20 +337,25 @@ public UnverifiedBiscuit copy() throws Error {

    public Biscuit verify(PublicKey publicKey) throws Error, NoSuchAlgorithmException, SignatureException, InvalidKeyException {
        SerializedBiscuit serializedBiscuit = this.serializedBiscuit;
-        serializedBiscuit.verify(publicKey);
+        var result = serializedBiscuit.verify(publicKey);


Good catch, I will check the impact to remove vavr in the future. It is not the best fit for our purpose.

Korbik · 2025-01-15T13:54:01Z

The failing test from the specification is linked to this PR eclipse-biscuit/biscuit#175

itstheceo · 2025-01-16T00:07:04Z

The failing test from the specification is linked to this PR biscuit-auth/biscuit#175

Thanks for the review, will address those comments 🚀

Regarding the test you updated; is that test036_secp256r1.bc signed with the v1 signature format, and the implementation needs updating to handle that?

Korbik · 2025-01-16T10:05:27Z

The failing test from the specification is linked to this PR biscuit-auth/biscuit#175

Thanks for the review, will address those comments 🚀

Regarding the test you updated; is that test036_secp256r1.bc signed with the v1 signature format, and the implementation needs updating to handle that?

Yes, it is necessary to update the signature and verification of the signature. We have also a new format of protobuf message. Let me know if you want me to care of it or prefer to implement it yourself.

https://github.com/biscuit-auth/biscuit-rust/pull/108/files

itstheceo · 2025-01-17T00:25:28Z

The failing test from the specification is linked to this PR biscuit-auth/biscuit#175

Thanks for the review, will address those comments 🚀
Regarding the test you updated; is that test036_secp256r1.bc signed with the v1 signature format, and the implementation needs updating to handle that?

Yes, it is necessary to update the signature and verification of the signature. We have also a new format of protobuf message. Let me know if you want me to care of it or prefer to implement it yourself.

Updating the Java implementation to the latest Biscuit spec feels like a separate task from adding support for ECDSA keys, and should be in it's own PR. I have updated test036_secp256r1.bc from the rust PR equivalent for ECDSA key support eclipse-biscuit/biscuit-rust#108

divarvel · 2025-01-17T09:53:55Z

agreed that is a separate task. we will need to carry it out right away because as of now in biscuit-rust, the use of P256 triggers the use of v1 signatures.

itstheceo and others added 24 commits May 20, 2024 13:44

p256 in progress, commit before updating tests

1c5789b

just want to get plumbed in and existing tests passing

p256 update existing tests

15a93d7

p256 keypair impl

31bdef7

p256 struggles

46eda04

return seed bytes like Ed.. feels weird though

fac0939

fix for padding

dab7d6a

fix it

6455586

exception cleanup since adding BC

658d120

cleanup more of the mess i made early on

adc8f83

add provided secp256r1 sample

13b8a68

get the new test passing

a42407a

update samples readme as per rust pr

5ade42e

cleaning up exceptions, imports

57da835

squash condition

bfada32

resolve todos by making attenuation specify the algorithm to use

b500faf

accomodate for variable length ecdsa signature, and throw errors duri…

6b1c00b

…ng verify

amend secp256r1 signature length check

b5ca28c

Merge pull request eclipse-biscuit#3 from biscuit-auth/master

984132f

sync upstream

Merge pull request eclipse-biscuit#5 from biscuit-auth/master

72d0ed1

Implement 3rd party block creation (eclipse-biscuit#104)

Merge branch 'master' into ec_p256

eb470ca

Merge branch 'master' into ec_p256

e138303

# Conflicts: # src/main/java/org/biscuitsec/biscuit/token/UnverifiedBiscuit.java

post merge compile fix

0e84b05

itstheceo mentioned this pull request Nov 26, 2024

Add ECDSA key support (SECP256R1) #101

Closed

Korbik requested changes Jan 15, 2025

View reviewed changes

Korbik force-pushed the ec_p256 branch from 2675742 to 319ff4a Compare January 15, 2025 13:47

Test with SPECIFICATION’s samples

7b049c6

Korbik force-pushed the ec_p256 branch from 319ff4a to 7b049c6 Compare January 15, 2025 14:07

review feedback, less the failing test

48c2bac

copy test036_secp256r1 from equivalent rust ecdsa pr

fbeb4c1

https://github.com/biscuit-auth/biscuit-rust/pull/108/files

final class for Ed25519Keypair

a27f89b

Korbik merged commit 20f3907 into eclipse-biscuit:master Jan 17, 2025
1 check passed

ghubstan mentioned this pull request Jan 18, 2025

Make Java implementation more idiomatic #110

Closed

preuss-adam mentioned this pull request Feb 11, 2025

Fix deserialization of root key id #112

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add ECDSA key support (SECP256R1) again #108

Add ECDSA key support (SECP256R1) again #108

Uh oh!

itstheceo commented Nov 26, 2024 •

edited

Loading

Uh oh!

Korbik left a comment

Uh oh!

Uh oh!

Korbik Jan 15, 2025

Uh oh!

Korbik Jan 15, 2025

Uh oh!

Korbik Jan 15, 2025

Uh oh!

Korbik Jan 15, 2025

Uh oh!

Korbik Jan 15, 2025

Uh oh!

Korbik commented Jan 15, 2025

Uh oh!

itstheceo commented Jan 16, 2025

Uh oh!

Korbik commented Jan 16, 2025

Uh oh!

itstheceo commented Jan 17, 2025

Uh oh!

divarvel commented Jan 17, 2025

Uh oh!

Uh oh!

Uh oh!

	class SECP256R1KeyPair extends KeyPair {
	final class SECP256R1KeyPair extends KeyPair {

Add ECDSA key support (SECP256R1) again #108

Add ECDSA key support (SECP256R1) again #108

Uh oh!

Conversation

itstheceo commented Nov 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Korbik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Korbik Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Korbik Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Korbik Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Korbik Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Korbik Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Korbik commented Jan 15, 2025

Uh oh!

itstheceo commented Jan 16, 2025

Uh oh!

Korbik commented Jan 16, 2025

Uh oh!

itstheceo commented Jan 17, 2025

Uh oh!

divarvel commented Jan 17, 2025

Uh oh!

Uh oh!

Uh oh!

itstheceo commented Nov 26, 2024 •

edited

Loading