Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8286908

ECDSA signature should not return parameters

    XMLWordPrintable

Details

    Description

      The Signature::getParameters API can be used by a signer to combine its output along with the signature algorithm OID to create an algorithm identifier so that the verifier has enough info to verify the signature.

      According to The ECDSA signature scheme for X.509 at https://datatracker.ietf.org/doc/html/rfc5758#section-3.2,

         When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or
         ecdsa-with-SHA512 algorithm identifier appears in the algorithm field
         as an AlgorithmIdentifier, the encoding MUST omit the parameters
         field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one
         component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-
         SHA384, or ecdsa-with-SHA512.

      Notice the "MUST omit the parameters field" words inside. However, Java's ECDSA impl allows setting parameters and returning it at https://github.com/openjdk/jdk/blob/29e0f1386d247731e8733f6fdd1307642b2b9f96/src/jdk.crypto.ec/share/classes/sun/security/ec/ECDSASignature.java#L530.

      Attachments

        Issue Links

          Activity

            People

              weijun Weijun Wang
              weijun Weijun Wang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: