RE: ECDSA signature reproducibility

yes — Thu, 27 Jun 2019 11:41:17 GMT

Regarding curve both sides is configured to secp256r1 curve

PC side:

private static ECDsa LoadPrivateKey(byte[] key)
{
var privKeyInt = new Org.BouncyCastle.Math.BigInteger(+1, key);
var parameters = SecNamedCurves.GetByName("secp256r1");
var ecPoint = parameters.G.Multiply(privKeyInt);
var privKeyX = ecPoint.Normalize().XCoord.ToBigInteger().ToByteArrayUnsigned();
var privKeyY = ecPoint.Normalize().YCoord.ToBigInteger().ToByteArrayUnsigned();

var d = privKeyInt.ToByteArrayUnsigned();
return ECDsa.Create(new ECParameters
{
Curve = ECCurve.NamedCurves.nistP256,
D = privKeyInt.ToByteArrayUnsigned(),
Q = new ECPoint
{
X = privKeyX,
Y = privKeyY
}
});
}

for device side:

/*static*/ bool
bIsValidSignature(const uint8_t* a_ipHashMessage, const uint8_t* a_ipSignature, uint8_t* a_ipEcdsaPublicKey)
// Brief: verify signature
// Get: a_ipHashMessage - message
// a_ipSignature - signature
// a_ipEcdsaPublicKey - public key
// Return: true if successful, false otherwise
// Pre: -
// Post: signature verified
// Method: Trivial
{
// swap endian
// ~~~~~~~~~~~
uint8_t l_iaPkCopy[d_iAuthPubKeySize];
nrf_crypto_internal_double_swap_endian(l_iaPkCopy, a_ipEcdsaPublicKey, d_iAuthPubKeySize / 2);

// ecc public key from raw
// ~~~~~~~~~~~~~~~~~~~~~~~
nrf_crypto_ecc_public_key_t l_uPublicKey;
if (NRF_SUCCESS != nrf_crypto_ecc_public_key_from_raw(&g_nrf_crypto_ecc_secp256r1_curve_info, &l_uPublicKey, l_iaPkCopy, d_iAuthPubKeySize))
{
LOG_WARNING(LOG_PRINT_CRYPTO, "Crypto - verify signature - failed - ecc public key from raw");
return false;
}

// verify the message using ECDSA and SHA-256
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
if (NRF_SUCCESS != nrf_crypto_ecdsa_verify(NULL, &l_uPublicKey, a_ipHashMessage, d_iAuthHashSize, a_ipSignature, d_iAuthSigLen))
{
LOG_WARNING(LOG_PRINT_CRYPTO, "Crypto - verify signature - failed - ECDSA verify");
return false;
}

return true;
}

Regarding endianness:

Device code swaps it before verifying

PC run on Win 10 which is little endian

RE: ECDSA signature reproducibility

tesc — Thu, 27 Jun 2019 11:28:16 GMT

Hi,

Have you double checked that you use the correct curve in both ends, and that you have not introduced any errors when copying the keys e.g. due to endianness or how they are otherwise encoded?

Regards,
Terje

RE: ECDSA signature reproducibility

yes — Thu, 27 Jun 2019 09:24:50 GMT

The reason for different signatures is the random number which is generated for each cycle as part of the Alice's signing process