No interop tests for ECDSA signatures

[RJPercival]

There don't appear to be any interop tests that use ECDSA signatures. An interop test suite for ECDSA signatures can be found here: https://www.w3.org/TR/xmldsig-core1-interop/

[kislyuk]

Thanks for your suggestion. I have looked into this and unfortunately it turns out that the test suite at https://www.w3.org/TR/xmldsig-core1-interop/ uses the RFC4050 extensions to the XML Signature standard, which are not compatible with the main standard (see also https://www.w3.org/TR/xmldsig-core/#sec-RFC4050Compat). Support for RFC4050 is outside the scope of this library, and the relevant portions of that test suite won't pass without such support.

In light of this, it would be nice to find a different, more up to date set of ECDSA test vectors to help regression test your contributions in #150.

[RJPercival]

Are you sure that they all use the RFC4050 extensions? I'm not particularly familiar with xmldsig, so correct me if I'm wrong, but it sounds like only half of the test suite uses those extensions (note that 12 test vectors use "RFC4050 ECDSAKeyValue" and the other 12 use "XML Signature 1.1 ECKeyValue"):

https://www.w3.org/TR/xmldsig-core1-interop/#sec-main-ECC-test-cases:

2.2 Elliptic Curve Test Cases (not including SHA-224)

Various combinations of the following

• Digest algorithm - SHA1/256/384/512
• Signature algorithm - ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512)
• Canonicalization algorithm - C14N 1.0, Exc C14N 1.0
• KeyInfo format - RFC 4050 style ECDSA KeyValue, XML signature 1.1 style ECKeyValue

Microsoft's test vectors - 48 files

• 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), RFC4050 ECDSAKeyValue
• 12 files: All of the above but with Exclusive C14N 1.0
• 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), XML Signature 1.1 ECKeyValue
• 12 files: All of the above but with Exclusive C14N 1.0

Oracle's test vectors - 18 files

• 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), RFC4050 ECDSAKeyValue
• 12 files: all of the above XML Signature 1.1 ECKeyValue

[kislyuk]

Where are the Microsoft test vectors? I only see the Oracle ones in https://www.w3.org/TR/xmldsig-core1-interop/interop/xmldsig11/.

[kislyuk]

Ah I see what you mean. I looked again in https://www.w3.org/TR/xmldsig-core1-interop/interop/xmldsig11/oracle/ and found the two sets of files, thanks.

[kislyuk]

@RJPercival I'm getting the following assertion errors from code that you introduced with the test vectors you suggested:

*** ./test/interop/TR2012/signature-enveloping-p521_sha512.xml Expected 130 byte SignatureValue, got 132 Expected 130 byte SignatureValue, got 132
*** ./test/interop/TR2012/signature-enveloping-p521_sha384.xml Expected 130 byte SignatureValue, got 132 Expected 130 byte SignatureValue, got 132
*** ./test/interop/TR2012/signature-enveloping-p521_sha224.xml Expected 130 byte SignatureValue, got 132 Expected 130 byte SignatureValue, got 132
*** ./test/interop/TR2012/signature-enveloping-p521_sha1.xml Expected 130 byte SignatureValue, got 132 Expected 130 byte SignatureValue, got 132
*** ./test/interop/TR2012/signature-enveloping-p521_sha256.xml Expected 130 byte SignatureValue, got 132 Expected 130 byte SignatureValue, got 132

Do you have any ideas on why the mismatch might occur? It's not clear to me how to fix it.

[RJPercival]

Ah that's a bug specific to p521, due to the line below:

signxml/signxml/__init__.py

Line 385 in 06e5f93

int_len = key.key_size // 8

It should be rounding up, rather than rounding down (we're currently losing a single byte from each of r and s). This isn't a problem with other curves because their key size is a multiple of 8.

[RJPercival]

The same bug exists here as well:

signxml/signxml/__init__.py

Line 588 in 06e5f93

want_raw_signature_len = key_size_bits // 8 * 2

[RJPercival]

Would you like me to provide a fix, or is that information sufficient for you to do so?

[kislyuk]

It would be great if you could provide a fix. I will then add the tests.

[RJPercival]

Could you retry those tests with #153 please?

[kislyuk]

It works, thanks! I am just working on fixing the last few failures before it's ready to go: #154

*** ./test/interop/TR2012/signature-enveloping-x509digest-rsa.xml Expected to find an X509Certificate element in the signature (X509SubjectName, X509SKI are not supported) Expected to find an X509Certificate element in the signature (X509SubjectName, X509SKI are not supported)
*** ./test/interop/TR2012/signature-enveloping-derencoded-ec.xml Expected to find either KeyValue or X509Data XML element in KeyInfo Expected to find either KeyValue or X509Data XML element in KeyInfo
*** ./test/interop/TR2012/signature-enveloping-derencoded-rsa.xml Expected to find either KeyValue or X509Data XML element in KeyInfo Expected to find either KeyValue or X509Data XML element in KeyInfo
*** ./test/interop/TR2012/signature-enveloping-keyinforeference-rsa.xml Expected to find either KeyValue or X509Data XML element in KeyInfo Expected to find either KeyValue or X509Data XML element in KeyInfo

[kislyuk]

Fixed in #154 (X509Digest and KeyInfoReference not supported)