Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread Stefan Berger
On 1/27/21 11:12 AM, Nym Seddon wrote: Hi Stefan, In the recommendations from SafeCurves (https://safecurves.cr.yp.to/twist.html) there are a number of attacks against ECC twists. Two of those attacks are relevant against NIST P192: invalid-curve attacks and invalid-curve attacks against ladd

Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread David Howells
Herbert Xu wrote: > > I've pulled this into my keys-next branch. > > David, please drop them because there are issues with the Crypto API > bits. Okay, dropped. David

Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread Herbert Xu
On Wed, Jan 27, 2021 at 02:22:08PM +, David Howells wrote: > > I've pulled this into my keys-next branch. David, please drop them because there are issues with the Crypto API bits. Thanks, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.

Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread Nym Seddon
Hi Stefan, In the recommendations from SafeCurves (https://safecurves.cr.yp.to/twist.html) there are a number of attacks against ECC twists. Two of those attacks are relevant against NIST P192: invalid-curve attacks and invalid-curve attacks against ladders. Both attacks can be mitigated by ch

Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread David Howells
Stefan Berger wrote: > This series of patches adds support for x509 certificates signed by a CA > that uses NIST p256 or p192 keys for signing. It also adds support for > certificates where the public key is a NIST p256 or p192 key. The math > for ECDSA signature verification is also added. > >

Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread David Howells
Stefan Berger wrote: > k=$(keyctrl newring test @u) keyctl - but I can fix that. David

[PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

2021-01-27 Thread Stefan Berger
From: Stefan Berger This series of patches adds support for x509 certificates signed by a CA that uses NIST p256 or p192 keys for signing. It also adds support for certificates where the public key is a NIST p256 or p192 key. The math for ECDSA signature verification is also added. Since self-si