Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for ED25519ph for sign/verify(-blob) commands #3479

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add support for ED25519ph for sign/verify(-blob) commands #3479

wants to merge 4 commits into from
+457 −158

Commits on Feb 29, 2024

  1. Used LoadOptions for more flexibility 

    * Use ED25519ph algorithm with sign/verify-blob commands

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
    @ret2libc
    ret2libc committed Feb 29, 2024
    Configuration menu
    Copy the full SHA
    7f0717d View commit details
    Browse the repository at this point in the history

  2. Attempt verification with ED25519 if ED25519ph is used for compatibility 

    Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
    @ret2libc
    ret2libc committed Feb 29, 2024
    Configuration menu
    Copy the full SHA
    260978c View commit details
    Browse the repository at this point in the history

  3. Use a diffrent Signer when interacting with Fulcio 

    ED25519-ph is not widely supported and it is not an accepted option in
x509 Certificates/CSR, so Fulcio does not accept them. Instead, clients
are supposed to use PureED25519 when interacting with Fulcio.

This commit provides to the Fulcio code a separate SignerVerifier
created from the one loaded from the private key. This SignerVerifier is
usually of the same type, except when dealing with ED25519ph.

Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
    @ret2libc
    ret2libc committed Feb 29, 2024
    Configuration menu
    Copy the full SHA
    1046eea View commit details
    Browse the repository at this point in the history

Commits on Mar 1, 2024

  1. Use ED25519ph only when uploading to TLog 

    Signed-off-by: Riccardo Schirone <562321+ret2libc@users.noreply.github.com>
    @ret2libc
    ret2libc committed Mar 1, 2024
    Configuration menu
    Copy the full SHA
    e01c68c View commit details
    Browse the repository at this point in the history