如何从 Crypto++ ECDSA 中的签名体获取签名长度

Question

我使用 Crypto++ (libcrypto++ 1.11) 在我的应用程序中嵌入 JWT。我制作了使用 CryptoPP::ECDSA<CryptoPP::ECP, CryptoPP::SHA256> 算法（使用 secp256r1 曲线）签署和验证消息的方法。用于验证的令牌可以来自外部世界，因此我需要在知道 public 密钥的情况下验证令牌内容（文本数据）签名。

问题是 Crypto++ 会导致无效签名的 SegFault，这让我的 Web 服务器很痛苦。

我希望BER格式（库中默认的序列化格式）的签名具有固定长度，所以我只需要将签名的长度与某个常量进行比较即可。但是，我发现内容越大签名越大，所以需要更深入的方法。

bool ES256Verifier::Verify(const std::string& data,
                           const std::string& signature) {
    bool result = false;
    try {
      CryptoPP::StringSource ss(
          signature + data, true,
          new CryptoPP::SignatureVerificationFilter(
              verifier_,
              new CryptoPP::ArraySink((byte*)&result, sizeof(result))));
    } catch (const CryptoPP::BERDecodeErr& err) {
      LOG_WARNING() << "Signature `" << signature << "` has invalid (non-BER) format";
    } catch (const CryptoPP::Exception& ex) {
      LOG_WARNING() << "Signature verification has failed: " << ex.what();
    }
    return result;
}

验证器 verifier_ 已正确初始化（并成功验证令牌，除了 SegFaults），但给定 data = "" 和 signature = ""，例如，我总是得到 SegFault:

__memmove_avx_unaligned_erms 0x00007fb4b9da6b38
CryptoPP::ArraySink::Put2(unsigned char const*, unsigned long, int, bool) 0x00007fb4ba414fb2
CryptoPP::BufferedTransformation::ChannelPut2(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, int, bool) 0x00007fb4ba3acedc
CryptoPP::StringStore::CopyRangeTo2(CryptoPP::BufferedTransformation&, unsigned long long&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) const 0x00007fb4ba414e02
CryptoPP::BufferedTransformation::Peek(unsigned char*, unsigned long) const 0x00007fb4ba3ad74a
CryptoPP::Integer::Decode(CryptoPP::BufferedTransformation&, unsigned long, CryptoPP::Integer::Signedness) 0x00007fb4ba45885c
CryptoPP::Integer::Decode(unsigned char const*, unsigned long, CryptoPP::Integer::Signedness) 0x00007fb4ba458c16
CryptoPP::DL_VerifierBase<CryptoPP::ECPPoint>::InputSignature pubkey.h:1560
CryptoPP::SignatureVerificationFilter::LastPut(unsigned char const*, unsigned long) 0x00007fb4ba4159a0
CryptoPP::FilterWithBufferedInput::PutMaybeModifiable(unsigned char*, unsigned long, int, bool, bool) 0x00007fb4ba418107
CryptoPP::BufferedTransformation::ChannelPut2(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, int, bool) 0x00007fb4ba3acedc
CryptoPP::BufferedTransformation::TransferMessagesTo2(CryptoPP::BufferedTransformation&, unsigned int&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) 0x00007fb4ba3ad8fa
CryptoPP::BufferedTransformation::TransferAllTo2(CryptoPP::BufferedTransformation&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) 0x00007fb4ba3adb21
CryptoPP::SourceTemplate<CryptoPP::StringStore>::PumpAll2 filters.h:1238
CryptoPP::Source::PumpAll filters.h:1182
CryptoPP::Source::SourceInitialize filters.h:1215
CryptoPP::StringSource::StringSource filters.h:1271
jwt::signature::algorithm::ES256Verifier::Verify es256_verifier.cpp:40
ES256_SignatureTest_Test::TestBody es256_test.cpp:29
...

那么，有没有一种方法可以查看数据和签名并确定此特定组合是否会由于签名长度无效而导致 SegFault？

Answer 1

下面是一些使用字段元素、签名者和验证者确定签名长度的示例代码。第一个输出打印元素长度和 r||s 长度，因为 r||s 是 P1363 格式的签名。

第二个和第三个输出只是打印SignatureLength()的结果。您的程序应该拒绝短于 SignatureLength() 的签名。甚至尝试验证短签名也没有意义，因为它不好。

注意：这仅适用于DL_*签名方案（基于离散日志）。它不适用于 TF_* 签名方案（基于陷门函数）。

#include "cryptlib.h"
#include "eccrypto.h"
#include "osrng.h"
#include "oids.h"

#include <iostream>

int main(int argc, char* argv[])
{
    using namespace CryptoPP;
    AutoSeededRandomPool prng;

    ///// Element
    DL_GroupParameters_EC<ECP> params(ASN1::secp256r1());

    unsigned int elemLength = params.GetCurve().GetField().MaxElementByteLength();
    std::cout << "Element length: " << elemLength << std::endl;
    std::cout << "r||s length: " << 2*elemLength << std::endl;

    ///// Signer
    ECDSA<ECP, SHA256>::Signer signer;
    signer.AccessKey().Initialize(prng, params);

    unsigned int signerLength = signer.SignatureLength();
    std::cout << "Signer signature length: " << signerLength << std::endl;

    ///// Verifier
    ECDSA<ECP, SHA256>::Verifier verifier(signer);

    unsigned int verifierLength = verifier.SignatureLength();
    std::cout << "Verifier signature length: " << verifierLength << std::endl;

    return 0;
}

运行程序结果如下。

$ ./test.exe
Element length: 32
r||s length: 64
Signer signature length: 64
Verifier signature length: 64

如果您将曲线切换为 ASN1::secp521r1()，则运行程序会产生以下结果。

$ ./test.exe
Element length: 66
r||s length: 132
Signer signature length: 132
Verifier signature length: 132

如何从 Crypto++ ECDSA 中的签名体获取签名长度

How to get signature length from signature body in Crypto++ ECDSA

c++

crypto++

ecdsa