pg_ecdsa_verify
is a PostgreSQL extension for verifying ECDSA signatures,
implemented in Rust. It leverages
the pgrx framework for creating
PostgreSQL extensions in Rust. Is uses the
ecdsa_verify Rust crate by the
same author for the core ECDSA signature verification logic.
This extension aims to be a compatible drop-in replacement for the C-based
pg-ecdsa, with the same ecdsa_verify()
function signature for ease of integration.
By limiting the scope to verification, the extension remains simpler and easier to implement and audit. Since verification only involves public keys and no private keys, it is inherently secure against side-channel attacks and much easier to implement correctly than the signature generation algorithm.
The typical use case would be a client needing to authenticate against a server
where the public keys are stored in a PostgreSQL server. In this scenario, only
the signature verification algorithm is needed on the server side. This is why
the pg_ecdsa_verify
crate only exposes the ECDSA signature verification
algorithm.
- Compatibility: Supports multiple PostgreSQL versions (11 to 16).
- Elliptic Curves: Supports
secp256r1
andsecp256k1
curves. - Hash Functions: Supports SHA-256 for hashing input data.
- Performance: Written in Rust for better safety and performance.
- Testing: Comprehensive test suite to ensure reliability.
- Benchmarking: Includes benchmarks to measure performance.
Skip these steps if you've already installed these, or if you're on a different platform than Ubuntu/Debian in which case you should visit the links and follow the instructions for your platform.
-
Install Rust:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh source $HOME/.cargo/env
-
Install latest PostgreSQL:
https://www.postgresql.org/download/linux/ubuntu/
sudo apt install -y postgresql-common sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh sudo apt -y install postgresql sudo -u postgres createuser --superuser "$USER" createdb "$USER"
-
Install pgrx:
https://github.com/pgcentralfoundation/pgrx/
sudo apt install -y libclang-dev build-essential libreadline-dev \ zlib1g-dev flex bison libxml2-dev libxslt-dev libssl-dev libxml2-utils \ xsltproc ccache pkg-config cargo install --locked cargo-pgrx cargo pgrx init
-
Clone the repository:
git clone https://github.com/joelonsql/pg_ecdsa_verify.git cd pg_ecdsa_verify
-
Build and test the extension:
cargo pgrx test
-
Install the extension to PostgreSQL:
cargo pgrx install --sudo
The extension provides a single SQL function ecdsa_verify
to verify ECDSA signatures.
\dx+ pg_ecdsa_verify
Objects in extension "pg_ecdsa_verify"
Object description
-----------------------------------------------------------------
function ecdsa_verify.ecdsa_verify(bytea,bytea,bytea,text,text)
schema ecdsa_verify
(2 rows)
psql
CREATE EXTENSION pg_ecdsa_verify;
SELECT ecdsa_verify.ecdsa_verify(
public_key := '\x7fa92dd0666eee7c13ddb7b6249b0c8f9fba4360857c4e15d2fc634a2b5a1f8fdb9983b319469d35e719a3b93e1ac292854cd3ff2ad50898681b0a32ffbcbc6a'::bytea,
input_data := '\x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763010000000117bd119a942a38b92bfc3b90a21f7eaa37fe1a7fa0abe27fd15dd20683b14d54'::bytea,
signature := '\x10fab01307f3eed59bc11601265efaab524b50d017bd9cdfeec4f61b01caa8d669c6e9f8d9bcbdba4e5478cb75b084332d51b0be2c21701b157c7c87abb98057'::bytea,
hash_func := 'sha256',
curve_name := 'secp256r1'
);
ecdsa_verify
--------------
t
(1 row)
secp256r1
secp256k1
sha256
.
├── Cargo.toml
├── LICENSE
├── benches
│ └── ecdsa_verify.rs
├── pg_ecdsa_verify.control
├── sql
└── src
└── lib.rs
- Cargo.toml: Project metadata and dependencies.
- src/lib.rs: Main implementation file.
- benches/ecdsa_verify.rs: Benchmarking script.
- pg_ecdsa_verify.control: PostgreSQL extension control file.
To run the tests, use the following command:
cargo pgrx test
To benchmark the extension, ensure you are using the Rust Nightly toolchain, then use the following command:
cargo bench
The benchmarks were run on an Intel Core i9-14900K. The results are as follows:
$ cargo bench
Running benches/ecdsa_verify.rs (target/release/deps/ecdsa_verify-c81f65e672ca3ad2)
test bench_ecdsa_verify ... bench: 840,849 ns/iter (+/- 11,204)
This project is licensed under the MIT License. See the LICENSE file for details.
- The separate
ecdsa_verify
crate is based on v2.2.0 of the starkbank-ecdsa Python library by Star Bank. - Built using the pgrx framework.
Bugfixes, optimizations and simplifications are welcome, but no more features. Please open an issue or submit a pull request.