Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/ecdsa: remove unnecessary external package imports #38392

Closed
hallazzang opened this issue Apr 12, 2020 · 2 comments
Closed

crypto/ecdsa: remove unnecessary external package imports #38392

hallazzang opened this issue Apr 12, 2020 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unplanned

Comments

@hallazzang
Copy link
Contributor

hallazzang commented Apr 12, 2020 •
edited

go/src/crypto/ecdsa/ecdsa.go

Lines 107 to 112 in 83bfe3b

var b cryptobyte.Builder
b.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {
b.AddASN1BigInt(r)
b.AddASN1BigInt(s)
})
return b.Bytes()

go/src/crypto/ecdsa/ecdsa.go

Lines 318 to 330 in 83bfe3b

var (
r, s = &big.Int{}, &big.Int{}
inner cryptobyte.String
)
input := cryptobyte.String(sig)
if !input.ReadASN1(&inner, asn1.SEQUENCE) ||
!input.Empty() ||
!inner.ReadASN1Integer(r) ||
!inner.ReadASN1Integer(s) ||
!inner.Empty() {
return false
}
return Verify(pub, hash, r, s)

Here golang.org/x/crypto/cryptobyte package is used to marshal/unmarshal ASN.1 data structures, although there is encoding/asn1 already.
It is easy to replace cryptobyte with standard asn1 package, as shown below.

return asn1.Marshal([]*big.Int{r, s})
var seq []*big.Int
if _, err := asn1.Unmarshal(sig, &seq); err != nil {
	return false
}
return Verify(pub, hash, seq[0], seq[1])
@andybons
Copy link
Member

@katiehockman @FiloSottile

@andybons andybons added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Apr 13, 2020
@andybons andybons added this to the Unplanned milestone Apr 13, 2020
@FiloSottile
Copy link
Contributor

golang.org/x/crypto/cryptobyte is not a third-party package, but part of a module maintained by the Go team and already vendored into the standard library. Its use here is deliberate because it allows us to check that the ASN.1 sequences have no extra tags, which the encoding/asn1 version would allow.

@golang golang locked and limited conversation to collaborators Apr 13, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unplanned
Development

No branches or pull requests
4 participants
@andybons @FiloSottile @hallazzang @gopherbot