Comments (5)
I can't speak to the behaviour of CryptoKit in this context I'm afraid, that's a topic for the developer forums. In the BoringSSL-backed implementation the call stack that does this validation is:
swift-crypto/Sources/Crypto/Key Agreement/ECDH.swift
Lines 314 to 316 in a1b8005
using
calls
calls
swift-crypto/Sources/Crypto/Keys/EC/BoringSSL/NISTCurvesKeys_boring.swift
Lines 360 to 376 in a1b8005
calls
swift-crypto/Sources/Crypto/Keys/EC/BoringSSL/NISTCurvesKeys_boring.swift
Lines 493 to 503 in a1b8005
calls
swift-crypto/Sources/CCryptoBoringSSL/crypto/fipsmodule/ec/ec_key.c
Lines 372 to 395 in a1b8005
calls
swift-crypto/Sources/CCryptoBoringSSL/crypto/fipsmodule/ec/ec_key.c
Lines 294 to 330 in a1b8005
which performs the point validation in the various functions it calls, specifically confirming that the point is not the point at infinity and that it is the point on the curve.
from swift-crypto.
I think I asked a related question yesterday specifically on CryptoKit, and filed a documentation request in response. I'm interested in the answer for Crypto too.
from swift-crypto.
Thanks for filing this! @remko has kindly already received an answer on the developer forums, which is a better venue for this question, so I'll defer to that answer. To close the loop, swift-crypto's BoringSSL backend does point validation as well.
from swift-crypto.
To be clear, when does the point validation occur, and what does it include?
Mostly what I'm interested in is validating that points are actually on the curve when constructing a public key. I wrote a test to check that my library can catch this, because it seems that public key objects with points not on the curve will be created in CryptoKit.
To test if the point is on the curve I am exporting the raw representation of the key and the compressed representation of the key. I then use the compressed representation to construct a new key (which forces a point on the curve to be found). If the exported raw representation of this new key is not the same as the original, then a different point was recovered from compression (and so the original point was therefore not on the curve).
from swift-crypto.
Thanks!
It would seem that CryptoKit is behaving differently to that, which is a tad concerning 😬 Guess we'll need to chase that on the dev forums.
from swift-crypto.
Related Issues (20)
- Add sendable conformance to appropriate types HOT 7
- Umbrella: Update Wycheproof test vectors to v1 HOT 3
- QUIC Crypto Primitives Support HOT 6
- Handling Non Standard Keys Test Failed HOT 3
- Noncopyable / moveonly `PrivateKey` API? HOT 4
- New API Proposal: X.509 Certificate Support HOT 2
- Consider adding `_CRT_SECURE_NO_WARNINGS` to disable warnings on Windows. HOT 1
- Build failure with BUILD_LIBRARY_FOR_DISTRIBUTION=YES HOT 23
- No way to get PKCS#8 representation of private RSA key HOT 3
- Add Sendable annotation to Crypto Extras HOT 3
- How to set CBC padding behavior? HOT 6
- Validating HMACs with incremental computation HOT 1
- Linux armv7 support HOT 9
- Privacy manifest support HOT 6
- CBOR decoding and encoding?
- Can no longer build Swift-Crypto, from Swift-Certificates (X509) on Mac OS with the latest version (3.4.0) HOT 14
- On version 3.4.0 I have bug HOT 8
- Build issue beginning in v3.4.0 potentially related to added build target HOT 5
- CCryptoBoringSSL_ex_data.h:207:8: note: definition has no member 'ctx' HOT 14
- Error : Module 'CCryptoBoringSSL' is not present in definition of ... HOT 18
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from swift-crypto.