Skip to content

Support ECDSA with brainpool in TLS 1.3 - #5771

Merged
reneme merged 1 commit into
randombit:masterfrom
Rohde-Schwarz:rene/tls13_support_ecdsa_brainpool
Jul 30, 2026
Merged

Support ECDSA with brainpool in TLS 1.3#5771
reneme merged 1 commit into
randombit:masterfrom
Rohde-Schwarz:rene/tls13_support_ecdsa_brainpool

Conversation

@reneme

@reneme reneme commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

This is described in RFC 8734 and is essentially straight-forward: Adding explicit code points for ECDSA with Brainpool, similar to the additions in #5691. As before I wouldn't restrict those code points for usage in TLS 1.3 explicitly. Perhaps we shouldn't enable them by default, though.

Currently, that's really just a prove of concept (which succeeds in performing a handshake against a Bouncycastle server that is configured with a brainpool-based certificate). I need to go through this RFC and RFC 8446 once more to see if anything else has to be done (such as restricting the standard ECDSA code points to the NIST curves).

It would be nice to land that before Botan 3.13, if possible.

Closes #3811

@reneme reneme added this to the Botan 3.13 milestone Jul 28, 2026
@reneme reneme self-assigned this Jul 28, 2026
@reneme reneme added the enhancement Enhancement or new feature label Jul 28, 2026
@randombit

randombit commented Jul 28, 2026

Copy link
Copy Markdown
Owner

CI is failing, but yeah seems fine. BTW 3.13.0 would normally be Aug 4 but I pushed it a week so that any findings from Patch The Planet can get addressed prior to the release, rather than right after a release. So should be plenty of time to get this in.

@reneme
reneme force-pushed the rene/tls13_support_ecdsa_brainpool branch from 2e587e8 to 0faecba Compare July 29, 2026 07:33
@reneme

reneme commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator Author

CI is failing, but yeah seems fine.

Looks better now. It failed because Signature_Scheme::is_suitable_for() sanity-checked key lengths against the hash algorithm for RSA as well and thus rejected all schemes.

@reneme
reneme marked this pull request as ready for review July 29, 2026 09:19
Copilot AI review requested due to automatic review settings July 29, 2026 09:19
Copilot AI reviewed Jul 29, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@reneme

reneme commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

I'm happy with this patch as-is for now. A few lessons learned:

  1. There's currently no functional escape hatch to let users provide TLS signature schemes that aren't implemented or supported by Botan. If one overrides Policy::allowed_signature_schemes() and returns a "custom" code point, the TLS::Signature_Scheme::is_available() (and potentially others) will treat it as "unavailable" and the TLS implementation hard-rejects it therefore.
  2. Signature_Scheme::ECDSA_SHA256 (and friends) should be called ::ECDSA_SECP256R1_SHA256 (and respectively) because (at least in TLS 1.3) these code points are explicitly meant for the NIST curves. In TLS 1.2 the 16-bit code points are considered as two 8-bit code points for "SHA-xxx" and "ECDSA" respectively.
    Explicitly state Signature_Scheme::ECDSA_SECPxxxR1_TLS13_SHAxxx #5772
  3. The TLS::Text_Policy does not override allowed_signature_schemes() or accepted_signature_schemes(). Instead, the scheme lists are determined from allowed_signature_method() (i.e. "RSA", "ECDSA", ...) and allowed_signature_hash(). That was fine for the fairly liberal TLS 1.2 interpretation of the signature algorithms. But for TLS 1.3, currently the text policy cannot restrict the ECDSA schemes to just use NIST curves for instance.
    TLS::Text_Policy::allowed_signature_schemes() #5773
  4. Currently there's no proper test for a handshake with a Brainpool-based certificate.

All of the above are probably worth further investigation.

This was referenced Jul 29, 2026
Open
Draft
Merged
reneme added a commit to Rohde-Schwarz/botan that referenced this pull request Jul 29, 2026
@reneme
Explicitly state Signature_Scheme::ECDSA_SECP***R1_TLS13_SHA***
6b9147a 
TLS 1.3 explicitly means ECDSA on the NIST curves when using these code
points. Other code points exist for the Brainpool curves (GH randombit#5771).

In contrast, for TLS 1.2 these code points meant the usage of ECDSA on
any curve paired with the specified hash function.

To reflect this distinction in the code base, this introduces aliases
in the Signature_Scheme enum accordingly.
reneme added a commit to Rohde-Schwarz/botan that referenced this pull request Jul 29, 2026
@reneme
Explicitly state Signature_Scheme::ECDSA_SECP***R1_TLS13_SHA***
4c23d39 
TLS 1.3 explicitly means ECDSA on the NIST curves when using these code
points. Other code points exist for the Brainpool curves (GH randombit#5771).

In contrast, for TLS 1.2 these code points meant the usage of ECDSA on
any curve paired with the specified hash function.

To reflect this distinction in the code base, this introduces aliases
in the Signature_Scheme enum accordingly.
reneme added a commit to Rohde-Schwarz/botan that referenced this pull request Jul 29, 2026
@reneme
Explicitly state Signature_Scheme::ECDSA_SECP***R1_TLS13_SHA***
08ffe8f 
TLS 1.3 explicitly means ECDSA on the NIST curves when using these code
points. Other code points exist for the Brainpool curves (GH randombit#5771).

In contrast, for TLS 1.2 these code points meant the usage of ECDSA on
any curve paired with the specified hash function.

To reflect this distinction in the code base, this introduces aliases
in the Signature_Scheme enum accordingly.
@reneme
reneme force-pushed the rene/tls13_support_ecdsa_brainpool branch 2 times, most recently from d198bc6 to d28b387 Compare July 29, 2026 14:28
reneme added a commit to Rohde-Schwarz/botan that referenced this pull request Jul 29, 2026
@reneme
Explicitly state Signature_Scheme::ECDSA_SECP***R1_TLS13_SHA***
10b8e6d 
TLS 1.3 explicitly means ECDSA on the NIST curves when using these code
points. Other code points exist for the Brainpool curves (GH randombit#5771).

In contrast, for TLS 1.2 these code points meant the usage of ECDSA on
any curve paired with the specified hash function.

To reflect this distinction in the code base, this introduces aliases
in the Signature_Scheme enum accordingly.
@reneme
Support ECDSA with brainpool in TLS 1.3
cb68be5 
... as described in RFC 8734.

Closes randombit#3811
@reneme
reneme force-pushed the rene/tls13_support_ecdsa_brainpool branch from d28b387 to cb68be5 Compare July 29, 2026 14:39
@reneme

reneme commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator Author

Rebased after #5773 got merged (and adapted Signature_Scheme::from_string() accordingly).

@reneme
reneme merged commit dae02dd into randombit:master Jul 30, 2026
92 of 93 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@randombit randombit randombit approved these changes

Assignees

@reneme reneme

Labels

enhancement Enhancement or new feature

Projects

None yet

Milestone

Botan 3.13

Development

Successfully merging this pull request may close these issues.

TLS SignatureScheme lacks support for Brainpool

3 participants

@reneme @randombit