Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add secp256r1 curve host fns #807

Closed
dmkozh opened this issue May 15, 2023 · 8 comments · Fixed by #1376
Closed

Add secp256r1 curve host fns #807

dmkozh opened this issue May 15, 2023 · 8 comments · Fixed by #1376
Assignees
@leighmcculloch @jayz22
Labels
hostfunction Work on specific host functions

Comments

@dmkozh
Copy link
Contributor

dmkozh commented May 15, 2023

secp256r1 seems to be a reasonably popular curve, so it would be nice to add host-side support for it.
@jayz22 jayz22 added the hostfunction Work on specific host functions label May 21, 2023
@jayz22
Copy link
Contributor

jayz22 commented May 22, 2023

Related to #684 so we may add them together.

@anupsdf
Copy link
Contributor

anupsdf commented Jun 22, 2023

Moved to Post Soroban V1.

@tomerweller
Copy link

secp256r1 could enable passkey wallets without requiring signature transmutation

@tomerweller
Copy link

EIP-7212 adds motivation. Including these examples:

Apple’s Secure Enclave: There is a separate “Trusted Execution Environment” in Apple hardware which can sign arbitrary messages and can only be accessed by biometric identification.

Webauthn: Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn aims to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. It is being used by almost all of the modern web browsers.

Android Keystore: Android Keystore is an API that manages the private keys and signing methods. The private keys are not processed while using Keystore as the applications’ signing method. Also, it can be done in the “Trusted Execution Environment” in the microchip.

Passkeys: Passkeys is utilizing FIDO Alliance and W3C standards. It replaces passwords with cryptographic key-pairs which is also can be used for the elliptic curve cryptography.

@leighmcculloch
Copy link
Member

leighmcculloch commented Oct 3, 2023 •
edited

secp256r1

For the benefit of anyone else who didn't immediately recognize this curve, in most APIs and documentation it is referred to as P256, or P-256, or NIST P-256, or Ecdsa P-256, and to a lesser frequency prime256v1. In the Webauthn specification it is referred to as -7 or ES256.

It's one of the curves we discussed adding support to Stellar signers in CAP-43. The same benefits and motivations detailed in that proposal would also apply here. The big one being support by hardware security modules.

@leighmcculloch
Copy link
Member

secp256r1 could enable passkey wallets...

I think supporting just secp256r1 would be sufficient to get decent passkey support.

I found some reports of some Windows machines only supporting RSA, and technically the Webauthn spec encourages at least supporting the following three schemes/algos:

  • -8 (Ed25519)
  • -7 (ES256)
  • -257 (RS256)

Ref: https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams

Where:

  • -7 (ES256) is secp256r1
  • -257 (RS256) is RSASSA-PKCS1-v1_5 with SHA-256 RFC8017.

However, from best I can tell Ed25519 is not commonly supported, and a test we did confirmed ES256 is available on Windows in browners.

Also, supporting RSA would be challenging from a cost perspective as the keys and signatures are large. Keys and signatures would be 256-512 bytes.

We could support a limited set of passkeys that already support Ed25519 today, such as some Yubikeys.

@namankumar
Copy link
Member

namankumar commented Dec 22, 2023 •
edited

secp256r1 should be prioritized to support mobile wallets on Soroban. It makes account recovery UX of managed non-custodial wallets significantly easier than it is today.

@leighmcculloch leighmcculloch self-assigned this Jan 24, 2024
@jayz22 jayz22 self-assigned this Feb 26, 2024
@anupsdf
Copy link
Contributor

anupsdf commented Mar 14, 2024

We should do a quick survey of all libraries out there (other than p256) and do some due diligence before picking one.

This was referenced Mar 25, 2024
Merged
Merged
Merged
github-merge-queue bot pushed a commit that referenced this issue Apr 3, 2024
@jayz22
Add secp256r1 host function for signature verification (#1376)
97168ab 
### What

Resolves #807 by adding
a new host function `verify_sig_ecdsa_secp256r1` for ECDSA signature
verification using secp256r1 curve. The function accepts following
inputs:
- `public_key: BytesObject` containing the 65-byte SEC-1 uncompressed
ECDSA public key
- `msg_digest: BytesObject` a 32-byte hash of the message
- `signature`: the 64-byte signature `(r, s)` serialized as fixed-width
big endian scalars

The function is gated behind protocol 21 (`min_supported_protocol =
21`).

PR with the associated XDR changes:
stellar/stellar-xdr#178,
stellar/rs-stellar-xdr#355

#### Metering and Calibration
Two new cost types have been newly added:
- `Sec1DecodePointUncompressed`: constant cost type representing the
cost to decode the `public_key`
- `VerifyEcdsaSecp256r1Sig` : constant cost type represent the cost of
ECDSA sig verification

A prevous cost type `ComputeEcdsaSecp256k1Sig` has been renamed to
`DecodeEcdsaCurve256Sig`, which represents the cost of deserializing
both the `secp256k1` and `secp256r1` signatures.

Calibration: 
- each new cost type mentioned above have been benchmarked and
calibrated.
- plus a few experimental types have been added to answer key questions
regarding the host interface (will provide a supplemental doc soon).

#### Testing

Unit tests have been added to test against various forms of invalid
inputs.

In addition, two set of test vectors has been added in integration test:
- [NIST test
vectors](https://csrc.nist.gov/groups/STM/cavp/documents/dss/186-3ecdsatestvectors.zip)
- Google's [wycheproof](https://github.com/C2SP/wycheproof) test vectors
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@leighmcculloch leighmcculloch

@jayz22 jayz22

Labels
hostfunction Work on specific host functions
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add secp256r1 host function for signature verification jayz22/rs-soroban-env
7 participants
@namankumar @leighmcculloch @tomerweller @jayz22 @dmkozh @anupsdf and others