ecdsa_secp256r1_sha384_test.json, ecdsa_secp256r1_sha512_test.json, and ecdsa_secp384r1_sha256_test.json are missing about wycheproof

[thaidn]

@bleichen

[bleichen]

I'm adding more files for more curve/hash combination.
I'm however not sure about ecdsa_secp384r1_sha256.
This combination makes little sense since the security of the hash is
weaker than the curve. There are a few test vectors in ecdsa_test.json,
though these are marked as legacy cases. I.e. the result is "acceptable",
which means that I expect that some libraries reject such keys and signatures.

[briansmith]

I'm however not sure about ecdsa_secp384r1_sha256.
This combination makes little sense since the security of the hash is
weaker than the curve.

I agree it doesn't make sense. Unfortunately, before TLS 1.3, TLS clients can advertise "ECDSA + SHA-384" and "ECDSA + SHA-256" but they can't advertise which curves they support for each digest algorithm, since the supported curves are negotiated in a separate parameter. (In TLS 1.3 there is a fixed mapping: SHA-256 with P-256, SHA-384 with P-384.) A web-compatible TLS implementation either has to decide to reject signatures for which it technically advertised support or support this weird combination. I believe many implementations have chosen to support this weird combination.

[thaidn]

ecdsa_secp256r1_sha512_test.json was added.