> -----Original Message-----
> From: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>
> Sent: Wednesday, March 13, 2024 12:06 AM
> To: keyrings@xxxxxxxxxxxxxxx; linux-crypto@xxxxxxxxxxxxxxx;
> herbert@xxxxxxxxxxxxxxxxxxx; davem@xxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx; saulo.alessandre@xxxxxxxxxx;
> lukas@xxxxxxxxx; Bharat Bhushan <bbhushan2@xxxxxxxxxxx>;
> jarkko@xxxxxxxxxx; Stefan Berger <stefanb@xxxxxxxxxxxxx>
> Subject: [EXTERNAL] [PATCH v6 12/13] crypto: asymmetric_keys - Adjust
> signature size calculation for NIST P521
> ----------------------------------------------------------------------
> From: Stefan Berger <stefanb@xxxxxxxxxxxxx>
>
> Adjust the calculation of the maximum signature size for support of NIST
> P521. While existing curves may prepend a 0 byte to their coordinates (to
> make the number positive), NIST P521 will not do this since only the first bit in
> the most significant byte is used.
>
> If the encoding of the x & y coordinates requires at least 128 bytes then an
> additional byte is needed for the encoding of the length. Take this into account
> when calculating the maximum signature size.
>
> Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
> Reviewed-by: Lukas Wunner <lukas@xxxxxxxxx>
> Tested-by: Lukas Wunner <lukas@xxxxxxxxx>
> ---
> crypto/asymmetric_keys/public_key.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/crypto/asymmetric_keys/public_key.c
> b/crypto/asymmetric_keys/public_key.c
> index e5f22691febd..16cc0be28929 100644
> --- a/crypto/asymmetric_keys/public_key.c
> +++ b/crypto/asymmetric_keys/public_key.c
> @@ -233,6 +233,7 @@ static int software_key_query(const struct
> kernel_pkey_params *params,
> info->key_size = len * 8;
>
> if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
> + int slen = len;
> /*
> * ECDSA key sizes are much smaller than RSA, and thus could
> * operate on (hashed) inputs that are larger than key size.
> @@ -246,8 +247,19 @@ static int software_key_query(const struct
> kernel_pkey_params *params,
> * Verify takes ECDSA-Sig (described in RFC 5480) as input,
> * which is actually 2 'key_size'-bit integers encoded in
> * ASN.1. Account for the ASN.1 encoding overhead here.
> + *
> + * NIST P192/256/384 may prepend a '0' to a coordinate to
> + * indicate a positive integer. NIST P521 never needs it.
> */
> - info->max_sig_size = 2 * (len + 3) + 2;
> + if (strcmp(pkey->pkey_algo, "ecdsa-nist-p521") != 0)
> + slen += 1;
> + /* Length of encoding the x & y coordinates */
> + slen = 2 * (slen + 2);
> + /*
> + * If coordinate encoding takes at least 128 bytes then an
> + * additional byte for length encoding is needed.
> + */
> + info->max_sig_size = 1 + (slen >= 128) + 1 + slen;
Is "(slen >= 128)" valid for P192/256/384 also?
Thanks
-Bharat
> } else {
> info->max_data_size = len;
> info->max_sig_size = len;
> --
> 2.43.0
