Skip to content

Commit d6eeb90

Browse files
mcb30mcb30
committed
[crypto] Add OID-identified algorithms for ECDSA with SHA2 hash family
Signed-off-by: Michael Brown <mcb30@ipxe.org>
1 parent d14066e commit d6eeb90

8 files changed

Lines changed: 252 additions & 0 deletions

File tree

‎src/config/config_crypto.c‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,3 +215,23 @@ REQUIRE_OBJECT ( ecdhe_rsa_aes_gcm_sha256 );
215215
defined ( CRYPTO_CIPHER_AES_GCM ) && defined ( CRYPTO_DIGEST_SHA384 )
216216
REQUIRE_OBJECT ( ecdhe_rsa_aes_gcm_sha384 );
217217
#endif
218+
219+
/* ECDSA and SHA-224 */
220+
#if defined ( CRYPTO_PUBKEY_ECDSA ) && defined ( CRYPTO_DIGEST_SHA224 )
221+
REQUIRE_OBJECT ( ecdsa_sha224 );
222+
#endif
223+
224+
/* ECDSA and SHA-256 */
225+
#if defined ( CRYPTO_PUBKEY_ECDSA ) && defined ( CRYPTO_DIGEST_SHA256 )
226+
REQUIRE_OBJECT ( ecdsa_sha256 );
227+
#endif
228+
229+
/* ECDSA and SHA-384 */
230+
#if defined ( CRYPTO_PUBKEY_ECDSA ) && defined ( CRYPTO_DIGEST_SHA384 )
231+
REQUIRE_OBJECT ( ecdsa_sha384 );
232+
#endif
233+
234+
/* ECDSA and SHA-512 */
235+
#if defined ( CRYPTO_PUBKEY_ECDSA ) && defined ( CRYPTO_DIGEST_SHA512 )
236+
REQUIRE_OBJECT ( ecdsa_sha512 );
237+
#endif

‎src/config/crypto.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
2424
/** RSA public-key algorithm */
2525
#define CRYPTO_PUBKEY_RSA
2626

27+
/** ECDSA public-key algorithm */
28+
#define CRYPTO_PUBKEY_ECDSA
29+
2730
/** AES-CBC block cipher */
2831
#define CRYPTO_CIPHER_AES_CBC
2932

‎src/crypto/mishmash/ecdsa_sha224.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
* Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
3+
*
4+
* This program is free software; you can redistribute it and/or
5+
* modify it under the terms of the GNU General Public License as
6+
* published by the Free Software Foundation; either version 2 of the
7+
* License, or (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful, but
10+
* WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License
15+
* along with this program; if not, write to the Free Software
16+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17+
* 02110-1301, USA.
18+
*
19+
* You can also choose to distribute this program under the terms of
20+
* the Unmodified Binary Distribution Licence (as given in the file
21+
* COPYING.UBDL), provided that you have satisfied its requirements.
22+
*/
23+
24+
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
25+
26+
#include <ipxe/ecdsa.h>
27+
#include <ipxe/sha256.h>
28+
#include <ipxe/asn1.h>
29+
#include <ipxe/tls.h>
30+
31+
/** "ecdsa-with-SHA224" object identifier */
32+
static uint8_t oid_ecdsa_with_sha224[] = { ASN1_OID_ECDSA_WITH_SHA224 };
33+
34+
/** "ecdsa-with-SHA224" OID-identified algorithm */
35+
struct asn1_algorithm ecdsa_with_sha224_algorithm __asn1_algorithm = {
36+
.name = "ecdsaWithSHA224",
37+
.pubkey = &ecdsa_algorithm,
38+
.digest = &sha224_algorithm,
39+
.oid = ASN1_CURSOR ( oid_ecdsa_with_sha224 ),
40+
};
41+
42+
/** ECDSA with SHA-224 signature hash algorithm */
43+
struct tls_signature_hash_algorithm
44+
tls_ecdsa_sha224 __tls_sig_hash_algorithm = {
45+
.code = {
46+
.signature = TLS_ECDSA_ALGORITHM,
47+
.hash = TLS_SHA224_ALGORITHM,
48+
},
49+
.pubkey = &ecdsa_algorithm,
50+
.digest = &sha224_algorithm,
51+
};

‎src/crypto/mishmash/ecdsa_sha256.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
* Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
3+
*
4+
* This program is free software; you can redistribute it and/or
5+
* modify it under the terms of the GNU General Public License as
6+
* published by the Free Software Foundation; either version 2 of the
7+
* License, or (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful, but
10+
* WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License
15+
* along with this program; if not, write to the Free Software
16+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17+
* 02110-1301, USA.
18+
*
19+
* You can also choose to distribute this program under the terms of
20+
* the Unmodified Binary Distribution Licence (as given in the file
21+
* COPYING.UBDL), provided that you have satisfied its requirements.
22+
*/
23+
24+
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
25+
26+
#include <ipxe/ecdsa.h>
27+
#include <ipxe/sha256.h>
28+
#include <ipxe/asn1.h>
29+
#include <ipxe/tls.h>
30+
31+
/** "ecdsa-with-SHA256" object identifier */
32+
static uint8_t oid_ecdsa_with_sha256[] = { ASN1_OID_ECDSA_WITH_SHA256 };
33+
34+
/** "ecdsa-with-SHA256" OID-identified algorithm */
35+
struct asn1_algorithm ecdsa_with_sha256_algorithm __asn1_algorithm = {
36+
.name = "ecdsaWithSHA256",
37+
.pubkey = &ecdsa_algorithm,
38+
.digest = &sha256_algorithm,
39+
.oid = ASN1_CURSOR ( oid_ecdsa_with_sha256 ),
40+
};
41+
42+
/** ECDSA with SHA-256 signature hash algorithm */
43+
struct tls_signature_hash_algorithm
44+
tls_ecdsa_sha256 __tls_sig_hash_algorithm = {
45+
.code = {
46+
.signature = TLS_ECDSA_ALGORITHM,
47+
.hash = TLS_SHA256_ALGORITHM,
48+
},
49+
.pubkey = &ecdsa_algorithm,
50+
.digest = &sha256_algorithm,
51+
};

‎src/crypto/mishmash/ecdsa_sha384.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
* Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
3+
*
4+
* This program is free software; you can redistribute it and/or
5+
* modify it under the terms of the GNU General Public License as
6+
* published by the Free Software Foundation; either version 2 of the
7+
* License, or (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful, but
10+
* WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License
15+
* along with this program; if not, write to the Free Software
16+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17+
* 02110-1301, USA.
18+
*
19+
* You can also choose to distribute this program under the terms of
20+
* the Unmodified Binary Distribution Licence (as given in the file
21+
* COPYING.UBDL), provided that you have satisfied its requirements.
22+
*/
23+
24+
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
25+
26+
#include <ipxe/ecdsa.h>
27+
#include <ipxe/sha512.h>
28+
#include <ipxe/asn1.h>
29+
#include <ipxe/tls.h>
30+
31+
/** "ecdsa-with-SHA384" object identifier */
32+
static uint8_t oid_ecdsa_with_sha384[] = { ASN1_OID_ECDSA_WITH_SHA384 };
33+
34+
/** "ecdsa-with-SHA384" OID-identified algorithm */
35+
struct asn1_algorithm ecdsa_with_sha384_algorithm __asn1_algorithm = {
36+
.name = "ecdsaWithSHA384",
37+
.pubkey = &ecdsa_algorithm,
38+
.digest = &sha384_algorithm,
39+
.oid = ASN1_CURSOR ( oid_ecdsa_with_sha384 ),
40+
};
41+
42+
/** ECDSA with SHA-384 signature hash algorithm */
43+
struct tls_signature_hash_algorithm
44+
tls_ecdsa_sha384 __tls_sig_hash_algorithm = {
45+
.code = {
46+
.signature = TLS_ECDSA_ALGORITHM,
47+
.hash = TLS_SHA384_ALGORITHM,
48+
},
49+
.pubkey = &ecdsa_algorithm,
50+
.digest = &sha384_algorithm,
51+
};

‎src/crypto/mishmash/ecdsa_sha512.c‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
* Copyright (C) 2025 Michael Brown <mbrown@fensystems.co.uk>.
3+
*
4+
* This program is free software; you can redistribute it and/or
5+
* modify it under the terms of the GNU General Public License as
6+
* published by the Free Software Foundation; either version 2 of the
7+
* License, or (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful, but
10+
* WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12+
* General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License
15+
* along with this program; if not, write to the Free Software
16+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17+
* 02110-1301, USA.
18+
*
19+
* You can also choose to distribute this program under the terms of
20+
* the Unmodified Binary Distribution Licence (as given in the file
21+
* COPYING.UBDL), provided that you have satisfied its requirements.
22+
*/
23+
24+
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
25+
26+
#include <ipxe/ecdsa.h>
27+
#include <ipxe/sha512.h>
28+
#include <ipxe/asn1.h>
29+
#include <ipxe/tls.h>
30+
31+
/** "ecdsa-with-SHA512" object identifier */
32+
static uint8_t oid_ecdsa_with_sha512[] = { ASN1_OID_ECDSA_WITH_SHA512 };
33+
34+
/** "ecdsa-with-SHA512" OID-identified algorithm */
35+
struct asn1_algorithm ecdsa_with_sha512_algorithm __asn1_algorithm = {
36+
.name = "ecdsaWithSHA512",
37+
.pubkey = &ecdsa_algorithm,
38+
.digest = &sha512_algorithm,
39+
.oid = ASN1_CURSOR ( oid_ecdsa_with_sha512 ),
40+
};
41+
42+
/** ECDSA with SHA-512 signature hash algorithm */
43+
struct tls_signature_hash_algorithm
44+
tls_ecdsa_sha512 __tls_sig_hash_algorithm = {
45+
.code = {
46+
.signature = TLS_ECDSA_ALGORITHM,
47+
.hash = TLS_SHA512_ALGORITHM,
48+
},
49+
.pubkey = &ecdsa_algorithm,
50+
.digest = &sha512_algorithm,
51+
};

‎src/include/ipxe/asn1.h‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,30 @@ struct asn1_builder_header {
139139
ASN1_OID_DOUBLE ( 10045 ), ASN1_OID_SINGLE ( 3 ), \
140140
ASN1_OID_SINGLE ( 1 ), ASN1_OID_SINGLE ( 7 )
141141

142+
/** ASN.1 OID for ecdsa-with-SHA224 (1.2.840.10045.4.3.1) */
143+
#define ASN1_OID_ECDSA_WITH_SHA224 \
144+
ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ), \
145+
ASN1_OID_DOUBLE ( 10045 ), ASN1_OID_SINGLE ( 4 ), \
146+
ASN1_OID_SINGLE ( 3 ), ASN1_OID_SINGLE ( 1 )
147+
148+
/** ASN.1 OID for ecdsa-with-SHA256 (1.2.840.10045.4.3.2) */
149+
#define ASN1_OID_ECDSA_WITH_SHA256 \
150+
ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ), \
151+
ASN1_OID_DOUBLE ( 10045 ), ASN1_OID_SINGLE ( 4 ), \
152+
ASN1_OID_SINGLE ( 3 ), ASN1_OID_SINGLE ( 2 )
153+
154+
/** ASN.1 OID for ecdsa-with-SHA384 (1.2.840.10045.4.3.3) */
155+
#define ASN1_OID_ECDSA_WITH_SHA384 \
156+
ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ), \
157+
ASN1_OID_DOUBLE ( 10045 ), ASN1_OID_SINGLE ( 4 ), \
158+
ASN1_OID_SINGLE ( 3 ), ASN1_OID_SINGLE ( 3 )
159+
160+
/** ASN.1 OID for ecdsa-with-SHA512 (1.2.840.10045.4.3.4) */
161+
#define ASN1_OID_ECDSA_WITH_SHA512 \
162+
ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ), \
163+
ASN1_OID_DOUBLE ( 10045 ), ASN1_OID_SINGLE ( 4 ), \
164+
ASN1_OID_SINGLE ( 3 ), ASN1_OID_SINGLE ( 4 )
165+
142166
/** ASN.1 OID for rsaEncryption (1.2.840.113549.1.1.1) */
143167
#define ASN1_OID_RSAENCRYPTION \
144168
ASN1_OID_INITIAL ( 1, 2 ), ASN1_OID_DOUBLE ( 840 ), \

‎src/include/ipxe/tls.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ struct tls_header {
113113

114114
/* TLS signature algorithm identifiers */
115115
#define TLS_RSA_ALGORITHM 1
116+
#define TLS_ECDSA_ALGORITHM 3
116117

117118
/* TLS server name extension */
118119
#define TLS_SERVER_NAME 0

0 commit comments

Comments
 (0)