Add brainpoolP320r1 elliptic curve

Add brainpoolP320r1 (320-bit, OID 1.3.36.3.3.2.8.1.1.9) from RFC 5639.
This curve is fully supported by OpenSSL (NID 929) and used by the
Netherlands for DG15 Active Authentication keys in ePassport documents
per ICAO 9303.

brainpoolP224r1 is deferred as it requires a NID addition to the
openssl Rust crate first.

Author: sfarestam-iproov

src/cryptography/hazmat/primitives/asymmetric/ec.py

@@ -23,6 +23,7 @@ class EllipticCurveOID:
     SECP384R1 = ObjectIdentifier("1.3.132.0.34")
     SECP521R1 = ObjectIdentifier("1.3.132.0.35")
     BRAINPOOLP256R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.7")
+    BRAINPOOLP320R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.9")
     BRAINPOOLP384R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.11")
     BRAINPOOLP512R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.13")
 
@@ -265,6 +266,12 @@ class BrainpoolP256R1(EllipticCurve):
     )
 
 
+class BrainpoolP320R1(EllipticCurve):
+    name = "brainpoolP320r1"
+    key_size = 320
+    group_order = 0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311  # noqa: E501
+
+
 class BrainpoolP384R1(EllipticCurve):
     name = "brainpoolP384r1"
     key_size = 384
@@ -287,6 +294,7 @@ class BrainpoolP512R1(EllipticCurve):
     "secp521r1": SECP521R1(),
     "secp256k1": SECP256K1(),
     "brainpoolP256r1": BrainpoolP256R1(),
+    "brainpoolP320r1": BrainpoolP320R1(),
     "brainpoolP384r1": BrainpoolP384R1(),
     "brainpoolP512r1": BrainpoolP512R1(),
 }
@@ -354,6 +362,7 @@ class ECDH:
     EllipticCurveOID.SECP384R1: SECP384R1,
     EllipticCurveOID.SECP521R1: SECP521R1,
     EllipticCurveOID.BRAINPOOLP256R1: BrainpoolP256R1,
+    EllipticCurveOID.BRAINPOOLP320R1: BrainpoolP320R1,
     EllipticCurveOID.BRAINPOOLP384R1: BrainpoolP384R1,
     EllipticCurveOID.BRAINPOOLP512R1: BrainpoolP512R1,
 }

src/rust/cryptography-key-parsing/src/ec.rs

@@ -32,6 +32,8 @@ pub(crate) fn group_to_curve_oid(
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         openssl::nid::Nid::BRAINPOOL_P256R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP256R1),
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
+        openssl::nid::Nid::BRAINPOOL_P320R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP320R1),
+        #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         openssl::nid::Nid::BRAINPOOL_P384R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP384R1),
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         openssl::nid::Nid::BRAINPOOL_P512R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP512R1),
@@ -56,6 +58,8 @@ pub(crate) fn ec_params_to_group(
                 #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
                 &cryptography_x509::oid::EC_BRAINPOOLP256R1 => openssl::nid::Nid::BRAINPOOL_P256R1,
                 #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
+                &cryptography_x509::oid::EC_BRAINPOOLP320R1 => openssl::nid::Nid::BRAINPOOL_P320R1,
+                #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
                 &cryptography_x509::oid::EC_BRAINPOOLP384R1 => openssl::nid::Nid::BRAINPOOL_P384R1,
                 #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
                 &cryptography_x509::oid::EC_BRAINPOOLP512R1 => openssl::nid::Nid::BRAINPOOL_P512R1,

src/rust/cryptography-x509/src/oid.rs

@@ -60,6 +60,7 @@ pub const EC_SECP521R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 132, 0, 35);
 pub const EC_SECP256K1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 132, 0, 10);
 
 pub const EC_BRAINPOOLP256R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 7);
+pub const EC_BRAINPOOLP320R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 9);
 pub const EC_BRAINPOOLP384R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 11);
 pub const EC_BRAINPOOLP512R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 13);
 

src/rust/src/backend/ec.rs

@@ -50,6 +50,8 @@ fn curve_from_py_curve(
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         "brainpoolP256r1" => openssl::nid::Nid::BRAINPOOL_P256R1,
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
+        "brainpoolP320r1" => openssl::nid::Nid::BRAINPOOL_P320R1,
+        #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         "brainpoolP384r1" => openssl::nid::Nid::BRAINPOOL_P384R1,
         #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))]
         "brainpoolP512r1" => openssl::nid::Nid::BRAINPOOL_P512R1,