Subject: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: ecdsap256 clarifications (#38)

From: Brian Campbell <[email-masked]>
Date: Thu, 19 May 2016 09:30:06 -0700

Is ecdsap256 the NIST P-256 curve (also known as, I think, X9.62 prime256v1 or SECG secp256r1)? I'm guessing so but it's not totally clear from the document. The relevant text (that I could find anyway) from TBPROTO-03 here:

>    When an ecdsap256 key is used, TokenBinding.signature contains a pair
>    of integers, R followed by S, as defined in [ANSI.X9-62.2005].  R and
>    S are encoded in big-endian format.  ECPoint.point contains the X
>    coordinate followed by the Y coordinate.  The X and Y coordinates are
>    unsigned integers encoded in big-endian format.

I was going to suggest that TBPROTO explicitly say that for ecdsap256 R & S and X & Y always be exactly 32 octets/bytes long and that any leading zero bytes be preserved (rare but possible AFAIK), which I assume was the intent so that the point and signature can be consistently processed. Then I thought maybe I should first look at ANSI.X9-62 to see if this was already clearly stated there somewhere. But it seems that one can't actually read X9-62 without shelling out $100, which is a lot to just look for a little details like that.  

So, from that fun little story (sorry!), a couple comments/questions/suggestions:

Can TBPROTO state the curve used with the ecdsap256 TB key parameters in a way that's easy and obvious? And maybe also cite a document that's a little more accessible than X9-62 in doing so?  I believe many RFCs, 7518/JWA for example, cite FIPS PUB 186-4 "Digital Signature Standard (DSS)" for ECDSA and the P-* curves. I expect most implementers will be using an existing ECDSA implementation and just need to get the parameters and input/output formatted correctly. That reference and the text in JWA was enough for many independent implementations to get it right with JWS.

And about getting the input/output formatted correctly, can or should TBPROTO say that R&S/X&Y are always 32 bytes and so leading zeros need to be added or retained?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/issues/38

---

From: Andrei-Popov <[email-masked]>
Date: Fri, 20 May 2016 12:09:47 -0700

Thanks for the feedback; I'll clarify in the next TBPROTO revision.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/issues/38#issuecomment-220693277

---

From: Andrei-Popov <[email-masked]>
Date: Fri, 20 May 2016 16:55:42 -0700

Closed #38.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/issues/38#event-667790556