Skip to content

Explicitly state Signature_Scheme::ECDSA_SECPxxxR1_TLS13_SHAxxx #5772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
reneme wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Explicitly state Signature_Scheme::ECDSA_SECPxxxR1_TLS13_SHAxxx #5772

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff7620a
Explicitly state Signature_Scheme::ECDSA_SECP***R1_TLS13_SHA***
reneme Jul 29, 2026
585419e
Use Text_Policy for scheme selection in RFC8448 cont'd
reneme Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/bogo_shim/bogo_shim.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1167,7 +1167,7 @@ class Shim_Policy final : public Botan::TLS::Policy {
if(!m_args.flag_set("server")) {
schemes.emplace_back(Botan::TLS::Signature_Scheme::RSA_PKCS1_SHA256);
schemes.emplace_back(Botan::TLS::Signature_Scheme::RSA_PSS_SHA256);
schemes.emplace_back(Botan::TLS::Signature_Scheme::ECDSA_SHA256);
schemes.emplace_back(Botan::TLS::Signature_Scheme::ECDSA_SECP256R1_TLS13_SHA256);
}

return schemes;
Expand Down
66 changes: 33 additions & 33 deletions src/lib/tls/tls_signature_scheme.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,9 @@ const std::vector<Signature_Scheme>& Signature_Scheme::all_available_schemes() {
// EDDSA_25519,
// #endif

ECDSA_SHA384,
ECDSA_SHA512,
ECDSA_SHA256,
ECDSA_SECP384R1_TLS13_SHA384,
ECDSA_SECP521R1_TLS13_SHA512,
ECDSA_SECP256R1_TLS13_SHA256,

RSA_PSS_SHA384,
RSA_PSS_SHA256,
Expand Down Expand Up @@ -68,14 +68,14 @@ Signature_Scheme Signature_Scheme::from_string(std::string_view str) {
if(str == "ECDSA_SHA1") {
return ECDSA_SHA1;
}
if(str == "ECDSA_SHA256") {
return ECDSA_SHA256;
if(str == "ECDSA_SHA256" || str == "ECDSA_SECP256R1_TLS13_SHA256") {
return ECDSA_SECP256R1_TLS13_SHA256;
}
if(str == "ECDSA_SHA384") {
return ECDSA_SHA384;
if(str == "ECDSA_SHA384" || str == "ECDSA_SECP384R1_TLS13_SHA384") {
return ECDSA_SECP384R1_TLS13_SHA384;
}
if(str == "ECDSA_SHA512") {
return ECDSA_SHA512;
if(str == "ECDSA_SHA512" || str == "ECDSA_SECP521R1_TLS13_SHA512") {
return ECDSA_SECP521R1_TLS13_SHA512;
}

if(str == "RSA_PSS_SHA256") {
Expand Down Expand Up @@ -129,9 +129,9 @@ bool Signature_Scheme::is_available() const noexcept {
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
case ECDSA_SHA384:
case ECDSA_SHA512:
case ECDSA_SHA256:
case ECDSA_SECP384R1_TLS13_SHA384:
case ECDSA_SECP521R1_TLS13_SHA512:
case ECDSA_SECP256R1_TLS13_SHA256:
return true;
default:
return false;
Expand All @@ -155,11 +155,11 @@ std::string Signature_Scheme::to_string() const {

case ECDSA_SHA1:
return "ECDSA_SHA1";
case ECDSA_SHA256:
case ECDSA_SECP256R1_TLS13_SHA256:
return "ECDSA_SHA256";
case ECDSA_SHA384:
case ECDSA_SECP384R1_TLS13_SHA384:
return "ECDSA_SHA384";
case ECDSA_SHA512:
case ECDSA_SECP521R1_TLS13_SHA512:
return "ECDSA_SHA512";

case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
Expand Down Expand Up @@ -192,19 +192,19 @@ std::string Signature_Scheme::hash_function_name() const {
case ECDSA_SHA1:
return "SHA-1";

case ECDSA_SHA256:
case ECDSA_SECP256R1_TLS13_SHA256:
case RSA_PKCS1_SHA256:
case RSA_PSS_SHA256:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
return "SHA-256";

case ECDSA_SHA384:
case ECDSA_SECP384R1_TLS13_SHA384:
case RSA_PKCS1_SHA384:
case RSA_PSS_SHA384:
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
return "SHA-384";

case ECDSA_SHA512:
case ECDSA_SECP521R1_TLS13_SHA512:
case RSA_PKCS1_SHA512:
case RSA_PSS_SHA512:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
Expand Down Expand Up @@ -232,13 +232,13 @@ std::string Signature_Scheme::padding_string() const {

case ECDSA_SHA1:
return "SHA-1";
case ECDSA_SHA256:
case ECDSA_SECP256R1_TLS13_SHA256:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
return "SHA-256";
case ECDSA_SHA384:
case ECDSA_SECP384R1_TLS13_SHA384:
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
return "SHA-384";
case ECDSA_SHA512:
case ECDSA_SECP521R1_TLS13_SHA512:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
return "SHA-512";

Expand Down Expand Up @@ -270,9 +270,9 @@ std::string Signature_Scheme::algorithm_name() const {
return "RSA";

case ECDSA_SHA1:
case ECDSA_SHA256:
case ECDSA_SHA384:
case ECDSA_SHA512:
case ECDSA_SECP256R1_TLS13_SHA256:
case ECDSA_SECP384R1_TLS13_SHA384:
case ECDSA_SECP521R1_TLS13_SHA512:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
Expand Down Expand Up @@ -301,11 +301,11 @@ AlgorithmIdentifier Signature_Scheme::key_algorithm_identifier() const {

switch(m_code) {
// case ECDSA_SHA1: not defined
case ECDSA_SHA256:
case ECDSA_SECP256R1_TLS13_SHA256:
return {"ECDSA", der_encode_oid("secp256r1")};
case ECDSA_SHA384:
case ECDSA_SECP384R1_TLS13_SHA384:
return {"ECDSA", der_encode_oid("secp384r1")};
case ECDSA_SHA512:
case ECDSA_SECP521R1_TLS13_SHA512:
return {"ECDSA", der_encode_oid("secp521r1")};

case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
Expand Down Expand Up @@ -347,13 +347,13 @@ AlgorithmIdentifier Signature_Scheme::algorithm_identifier() const {

case ECDSA_SHA1:
return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-1"), AlgorithmIdentifier::USE_EMPTY_PARAM);
case ECDSA_SHA256:
case ECDSA_SECP256R1_TLS13_SHA256:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-256"), AlgorithmIdentifier::USE_EMPTY_PARAM);
case ECDSA_SHA384:
case ECDSA_SECP384R1_TLS13_SHA384:
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-384"), AlgorithmIdentifier::USE_EMPTY_PARAM);
case ECDSA_SHA512:
case ECDSA_SECP521R1_TLS13_SHA512:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-512"), AlgorithmIdentifier::USE_EMPTY_PARAM);

Expand Down Expand Up @@ -384,9 +384,9 @@ std::optional<Signature_Format> Signature_Scheme::format() const noexcept {
return Signature_Format::Standard;

case ECDSA_SHA1:
case ECDSA_SHA256:
case ECDSA_SHA384:
case ECDSA_SHA512:
case ECDSA_SECP256R1_TLS13_SHA256:
case ECDSA_SECP384R1_TLS13_SHA384:
case ECDSA_SECP521R1_TLS13_SHA512:
case ECDSA_BRAINPOOL256R1_TLS13_SHA256:
case ECDSA_BRAINPOOL384R1_TLS13_SHA384:
case ECDSA_BRAINPOOL512R1_TLS13_SHA512:
Expand Down
26 changes: 23 additions & 3 deletions src/lib/tls/tls_signature_scheme.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,30 @@ class BOTAN_PUBLIC_API(3, 0) Signature_Scheme final {
RSA_PKCS1_SHA384 = 0x0501,
RSA_PKCS1_SHA512 = 0x0601,

// RFC 9846 4.3.3
// ECDSA algorithms: Indicates a signature algorithm using ECDSA,
// the corresponding curve as defined in NIST SP 800-186.
//
// In TLS 1.3 these code points specifically refer to the NIST curves
// P-256, P-384, and P-521. In contrast TLS 1.2 uses these code points
// for ECDSA on any curve paired with the specified hash function.
ECDSA_SECP256R1_TLS13_SHA256 = 0x0403,
ECDSA_SECP384R1_TLS13_SHA384 = 0x0503,
ECDSA_SECP521R1_TLS13_SHA512 = 0x0603,

// RFC 5246 7.4.1.4.1
// The client uses the "signature_algorithms" extension to indicate
// to the server which signature/hash algorithm pairs may be used in
// digital signatures.
//
// In TLS 1.2 the signature_algorithms extension contains pairs of hash
// and signature algorithms. For ECDSA these code points are not bound
// to a specific curve in contrast to TLS 1.3, where these code points
// imply the usage of NIST's P-256, P-384, and P-521 curves.
ECDSA_SHA1 = 0x0203, // not implemented
ECDSA_SHA256 = 0x0403,
ECDSA_SHA384 = 0x0503,
ECDSA_SHA512 = 0x0603,
ECDSA_SHA256 = ECDSA_SECP256R1_TLS13_SHA256,
ECDSA_SHA384 = ECDSA_SECP384R1_TLS13_SHA384,
ECDSA_SHA512 = ECDSA_SECP521R1_TLS13_SHA512,

RSA_PSS_SHA256 = 0x0804,
RSA_PSS_SHA384 = 0x0805,
Expand Down
2 changes: 1 addition & 1 deletion src/tests/data/tls-policy/rfc8448_psk_dhe.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ allow_dtls10 = false
allow_dtls12 = false
ciphers = AES-128/GCM ChaCha20Poly1305 AES-256/GCM
macs = AEAD
signature_schemes = ECDSA_SHA256 ECDSA_SHA384 ECDSA_SHA512 ECDSA_SHA1 RSA_PSS_SHA256 RSA_PSS_SHA384 RSA_PSS_SHA512 RSA_PKCS1_SHA256 RSA_PKCS1_SHA384 RSA_PKCS1_SHA512 RSA_PKCS1_SHA1 0x0402 0x0502 0x0602 0x0202
signature_schemes = RSA_PSS_SHA384 RSA_PSS_SHA256 RSA_PSS_SHA512 RSA_PKCS1_SHA384 RSA_PKCS1_SHA512 RSA_PKCS1_SHA256 ECDSA_SECP384R1_TLS13_SHA384 ECDSA_SECP521R1_TLS13_SHA512 ECDSA_SECP256R1_TLS13_SHA256
key_exchange_methods = ECDH DH ECDHE_PSK
key_exchange_groups = x25519 secp256r1 secp384r1
allow_insecure_renegotiation = false
Expand Down
23 changes: 1 addition & 22 deletions src/tests/test_tls_rfc8448.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1493,28 +1493,7 @@ class Test_TLS_RFC8448_Client : public Test_TLS_RFC8448 {

auto sort_our_extensions = [](Botan::TLS::Extensions& exts,
Botan::TLS::Connection_Side /* side */,
Botan::TLS::Handshake_Type msg_type) {
if(msg_type == Handshake_Type::ClientHello) {
exts.remove_extension(Signature_Algorithms::static_type());
// This is the preference order of signature algorithms that we
// used when we first implemented this test case. To stay
// compatible with the now hard-coded transcript, we pin the
// algorithm order of preference.
//
// NOLINTNEXTLINE(*-owning-memory)
exts.add(new Signature_Algorithms({
Signature_Scheme::RSA_PSS_SHA384,
Signature_Scheme::RSA_PSS_SHA256,
Signature_Scheme::RSA_PSS_SHA512,
Signature_Scheme::RSA_PKCS1_SHA384,
Signature_Scheme::RSA_PKCS1_SHA512,
Signature_Scheme::RSA_PKCS1_SHA256,
Signature_Scheme::ECDSA_SHA384,
Signature_Scheme::ECDSA_SHA512,
Signature_Scheme::ECDSA_SHA256,
}));
}

Botan::TLS::Handshake_Type /* msg_type */) {
// This is the order of extensions when we first introduced the PSK
// implementation and generated the transcript. To stay compatible
// with the now hard-coded transcript, we pin the extension order.
Expand Down
9 changes: 9 additions & 0 deletions src/tests/test_tls_signature_scheme.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,17 @@ std::vector<Test::Result> test_signature_scheme() {
result.test_u16_eq("RSA_PKCS1_SHA512", Sig::from_string("RSA_PKCS1_SHA512").wire_code(), Sig::RSA_PKCS1_SHA512);
result.test_u16_eq("ECDSA_SHA1", Sig::from_string("ECDSA_SHA1").wire_code(), Sig::ECDSA_SHA1);
result.test_u16_eq("ECDSA_SHA256", Sig::from_string("ECDSA_SHA256").wire_code(), Sig::ECDSA_SHA256);
result.test_u16_eq("ECDSA_SECP256R1_TLS13_SHA256",
Sig::from_string("ECDSA_SECP256R1_TLS13_SHA256").wire_code(),
Sig::ECDSA_SECP256R1_TLS13_SHA256);
result.test_u16_eq("ECDSA_SHA384", Sig::from_string("ECDSA_SHA384").wire_code(), Sig::ECDSA_SHA384);
result.test_u16_eq("ECDSA_SECP384R1_TLS13_SHA384",
Sig::from_string("ECDSA_SECP384R1_TLS13_SHA384").wire_code(),
Sig::ECDSA_SECP384R1_TLS13_SHA384);
result.test_u16_eq("ECDSA_SHA512", Sig::from_string("ECDSA_SHA512").wire_code(), Sig::ECDSA_SHA512);
result.test_u16_eq("ECDSA_SECP521R1_TLS13_SHA512",
Sig::from_string("ECDSA_SECP521R1_TLS13_SHA512").wire_code(),
Sig::ECDSA_SECP521R1_TLS13_SHA512);
result.test_u16_eq("RSA_PSS_SHA256", Sig::from_string("RSA_PSS_SHA256").wire_code(), Sig::RSA_PSS_SHA256);
result.test_u16_eq("RSA_PSS_SHA384", Sig::from_string("RSA_PSS_SHA384").wire_code(), Sig::RSA_PSS_SHA384);
result.test_u16_eq("RSA_PSS_SHA512", Sig::from_string("RSA_PSS_SHA512").wire_code(), Sig::RSA_PSS_SHA512);
Expand Down
Loading