On Wed May 29, 2024 at 2:15 AM EEST, Stefan Berger wrote: > > + ptr[TPM2_KEY_ECDSA_SIG_R_TAG] = 0x02; /* INTEGER */ > > + ptr[TPM2_KEY_ECDSA_SIG_R_SIZE] = SHA256_DIGEST_SIZE + r_0; > > The size of the signature has nothing to do with the size of the hash. > SHA256_DIGEST_SIZE (32) happens to match the number of bytes of a > coordinate of prime256v1 / NIST p256 but should fail when you use > secp521r1 / NIST p521 since then r or s may then be 66 or 67 bytes (if > most sign. bit is set) long. First remark did not go unnoticed, so thanks for both. There was not just much to comment on it :-) I could just replace the constant with a (range checked) variable read from the response and overall structure woud be the same. This will also mean that in the case of P521 also prefix byte (0x81) is required but just for the sequence I think, not for the integers. Finally, I need to implement p521 smoke test for testing this patch set. One big letdown that I only now have consciously realized, is that TCG does not have p256k1 in their algorithm repository. It is the basis for quite a few blockchain technologies. I wonder why... BR, Jarkko
