secure-systems-lab / dsse

A specification for signing methods and formats used by Secure Systems Lab projects.

Home Page:https://dsse.dev

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Wrong signature in example?

kommendorkapten opened this issue · comments

In the example in the bottom of the protocol.md we can see following example:

{"payload": "aGVsbG8gd29ybGQ=",
 "payloadType": "http://example.com/HelloWorld",
 "signatures": [{"sig": "y7BK8Mm8Mr4gxk4+G9X3BD1iBc/vVVuJuV4ubmsEK4m/8MhQOOS26ejx+weIjyAx8VjYoZRPpoXSNjHEzdE7nQ=="}]}

However, I think that the calculated signature is wrong. When developing a Go implementation of ITE-5 (PR is ready in a few days) I was not able to recreate this signature.
I looked at the reference implementation (Jupyter notebook) and noticed that the each run generated a new ECC key. I modified the Signer.generate method to look like this (use the keys from the protocol.md file):

  def generate(cls):
    return cls(ECC.construct(curve='P-256',
                             d=97358161215184420915383655311931858321456579547487070936769975997791359926199,
                             point_x=46950820868899156662930047687818585632848591499744589407958293238635476079160,
                             point_y=5640078356564379163099075877009565129882514886557779369047442380624545832820))

With this implementation I get deterministic result from running the notebook. Also I get the same signature as I get in my Go implementation.

Thanks for reporting. Sent #30 to fix, which also reimplements in Python so it's easier to read, edit, and test.