RustCrypto / RustCrypto/formats

Unable to build certificate with P384 from version 0.3.0

Open
#2,403 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
338
Forks
188
Avg merge
4d 6h
Merged PRs (30d)
15

Description

A number of type/trait changes have occured with 0.3.0. Notably, this has broken certificate building with ECDSA P384 Signing keys.

Consider:

let int_cert = builder
        .build::<_, DerSignature>(&root_signing_key)
        .expect("failed to build intermediate CA certificate");

Where root_signing_key is of the type SigningKey<NistP384>

This yields the following errors:

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: ecdsa::signature::Signer<ecdsa::der::Signature<NistP384>>` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `ecdsa::signature::Signer<ecdsa::der::Signature<NistP384>>` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: `ecdsa::SigningKey<C>` implements trait `ecdsa::signature::Signer<S>`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/signing.rs:180:1
    |
180 | / impl<C> Signer<Signature<C>> for SigningKey<C>
181 | | where
182 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
183 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<ecdsa::Signature<C>>`
...
282 | / impl<C> Signer<SignatureWithOid<C>> for SigningKey<C>
283 | | where
284 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
285 | |     C::Digest: AssociatedOid,
286 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<SignatureWithOid<C>>`
...
321 | / impl<C> Signer<der::Signature<C>> for SigningKey<C>
322 | | where
323 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
324 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
325 | |     der::MaxSize<C>: ArraySize,
326 | |     <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
    | |__________________________________________________________________________^ `ecdsa::signature::Signer<ecdsa::der::Signature<C>>`
    |
   ::: /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/recovery.rs:283:1
    |
283 | / impl<C> Signer<(Signature<C>, RecoveryId)> for SigningKey<C>
284 | | where
285 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
286 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<(ecdsa::Signature<C>, RecoveryId)>`
note: required by a bound in `build`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-cert-0.3.0/src/builder.rs:291:12
    |
289 |     fn build<S, Signature>(mut self, signer: &S) -> Result<Self::Output>
    |        ----- required by a bound in this associated function
290 |     where
291 |         S: Signer<Signature>,
    |            ^^^^^^^^^^^^^^^^^ required by this bound in `Builder::build`

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: Keypair` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `KeypairRef` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: the trait `KeypairRef` is implemented for `ecdsa::SigningKey<C>`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/signing.rs:568:1
    |
568 | / impl<C> KeypairRef for SigningKey<C>
569 | | where
570 | |     C: EcdsaCurve + CurveArithmetic,
571 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^
    = note: required for `&ecdsa::SigningKey<NistP384>` to implement `Keypair`
note: required by a bound in `build`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-cert-0.3.0/src/builder.rs:292:12
    |
289 |     fn build<S, Signature>(mut self, signer: &S) -> Result<Self::Output>
    |        ----- required by a bound in this associated function
...
292 |         S: Keypair + DynSignatureAlgorithmIdentifier,
    |            ^^^^^^^ required by this bound in `Builder::build`

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: DynSignatureAlgorithmIdentifier` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `SignatureAlgorithmIdentifier` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: the trait `SignatureAlgorithmIdentifier` is implemented for `ecdsa::SigningKey<C>`

The causes P385 certificate signers to fail to compile. Given the complexity of the types and traits involved I haven't been able to resolve this for a few hours :(

My assumption is that there are either missing traits or something silly that is being missed here.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the failing call in src/test_ca.rs:307 and compare it with the build bounds shown in x509-cert-0.3.0/src/builder.rs. Trace the P384 SigningKey trait implementations referenced in the compiler output, then verify that building a certificate with this signer compiles and succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.