Subject: [jose] Ticket #183 - Use tables to assocate size of keys, etc

From: "Jim Schaad" <[email-masked]>
Date: Sun, 12 Jan 2014 14:22:17 -0800

I have closed this issue, however the change that I really wanted was not
there.  This is an example of what I really wanted.

Jim

1.  Digital Signature with ECDSA

   The Elliptic Curve Digital Signature Algorithm (ECDSA) [DSS] provides

   for the use of Elliptic Curve cryptography, which is able to provide

   equivalent security to RSA cryptography but using shorter key sizes

   and with greater processing speed.  This means that ECDSA digital

   signatures will be substantially smaller in terms of length than

   equivalently strong RSA digital signatures.

   This specification defines the use of ECDSA using the P-256, P-384

  and P-521 curves.  These curves are defined in [DSS].  The

   association between the "alg" header parameter values, the curve, the

   hash function and the length of R and S can be found in the following

   table:

          +---------------------+-------+---------+-------------+

          | alg Parameter Value | Curve | Hash    | Len R and S |

          +---------------------+-------+---------+-------------+

          | ES256               | P-256 | SHA-256 | 256         |

          |                     |       |         |             |

          | ES384               | P-384 | SHA-384 | 384         |

          |                     |       |         |             |

          | ES512               | P-521 | SHA-512 | 521         |

          +---------------------+-------+---------+-------------+

   An ECDSA digital signature is generated as follows:

   1.  Generate a digital signature of the JWS Signing Input using

       appropriate ECDSA curve and hash function the desired private

       key.  The output will be the pair (R, S).

   2.  Turn R and S into octet sequences in big endian order, with each

       sequence being array being be CEILING(LEN(R))octets long.  The

       octet sequence representations MUST NOT be shortened to omit any

       leading zero octets contained in the values.

   3.  Concatenate the two octet sequences in the order R and then S.

       (Note that many ECDSA implementations will directly produce this

       concatenation as their output.)

   4.  The resulting octet sequence is the JWS Signature value.

   The ECDSA digital signature for a JWS is validated as follows:

   1.  Validate that the JWS Signature value is the correct length, if

       it is not the correct length then fail validation.  The signature

      value MUST be 2*CEILING(LEN(R)).

   2.  Split the signature value into two equal length octet sequences.

       From each octet sequence extract a bit sequence of the

       appropriate length.  The first array contains R and the second S

       (with both being in big endian octet order).

   3.  Submit the JWS Signing Input R, S, the public key (x, y), the

       curve and the hash function to the ECDSA validator.

   Examples using these algorithms are shown in Appendices A.3 and A.4

   of [JWS].