Merge pull request #135 from preuss-adam/apreuss/deterministic-ecdsa

Add support for deterministic ECDSA

Author: Korbik

src/main/java/org/eclipse/biscuit/crypto/KeyPair.java

@@ -35,12 +35,25 @@ public KeyPair generate(SecureRandom rng) {
       new Factory() {
         @Override
         public KeyPair generate(byte[] bytes) throws Error.FormatError.InvalidKeySize {
-          return new SECP256R1KeyPair(bytes);
+          return new SECP256R1KeyPair(bytes, true);
         }
 
         @Override
         public KeyPair generate(SecureRandom rng) {
-          return new SECP256R1KeyPair(rng);
+          return new SECP256R1KeyPair(rng, true);
+        }
+      };
+
+  public static final Factory DEFAULT_NONDETERMINISTIC_SECP256R1_FACTORY =
+      new Factory() {
+        @Override
+        public KeyPair generate(byte[] bytes) throws Error.FormatError.InvalidKeySize {
+          return new SECP256R1KeyPair(bytes, false);
+        }
+
+        @Override
+        public KeyPair generate(SecureRandom rng) {
+          return new SECP256R1KeyPair(rng, false);
         }
       };
 
@@ -69,9 +82,9 @@ public static KeyPair generate(Algorithm algorithm, byte[] bytes)
 
   public static KeyPair generate(Algorithm algorithm, SecureRandom rng) {
     if (algorithm == Algorithm.Ed25519) {
-      return ed25519Factory != null ? ed25519Factory.generate(rng) : new Ed25519KeyPair(rng);
+      return ed25519Factory.generate(rng);
     } else if (algorithm == Algorithm.SECP256R1) {
-      return secp256r1Factory != null ? secp256r1Factory.generate(rng) : new SECP256R1KeyPair(rng);
+      return secp256r1Factory.generate(rng);
     } else {
       throw new IllegalArgumentException("Unsupported algorithm");
     }

src/main/java/org/eclipse/biscuit/crypto/SECP256R1KeyPair.java

@@ -9,6 +9,7 @@
 import java.security.SecureRandom;
 import org.bouncycastle.crypto.digests.SHA256Digest;
 import org.bouncycastle.crypto.signers.ECDSASigner;
+import org.bouncycastle.crypto.signers.HMacDSAKCalculator;
 import org.bouncycastle.crypto.signers.StandardDSAEncoding;
 import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey;
 import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey;
@@ -30,12 +31,16 @@ final class SECP256R1KeyPair extends KeyPair {
 
   private final BCECPrivateKey privateKey;
   private final BCECPublicKey publicKey;
+  private final boolean deterministicNonce;
 
   static final String ALGORITHM = "ECDSA";
   static final String CURVE = "secp256r1";
   static final ECNamedCurveParameterSpec SECP256R1 = ECNamedCurveTable.getParameterSpec(CURVE);
 
-  SECP256R1KeyPair(byte[] bytes) throws Error.FormatError.InvalidKeySize {
+  SECP256R1KeyPair(byte[] bytes, boolean deterministicNonce)
+      throws Error.FormatError.InvalidKeySize {
+    this.deterministicNonce = deterministicNonce;
+
     if (bytes.length != BUFFER_SIZE) {
       throw new Error.FormatError.InvalidKeySize(bytes.length);
     }
@@ -51,7 +56,9 @@ final class SECP256R1KeyPair extends KeyPair {
     this.publicKey = publicKey;
   }
 
-  SECP256R1KeyPair(SecureRandom rng) {
+  SECP256R1KeyPair(SecureRandom rng, boolean deterministicNonce) {
+    this.deterministicNonce = deterministicNonce;
+
     byte[] bytes = new byte[BUFFER_SIZE];
     rng.nextBytes(bytes);
 
@@ -67,14 +74,28 @@ final class SECP256R1KeyPair extends KeyPair {
     this.publicKey = publicKey;
   }
 
+  /// By default sign message digests with a deterministic k
+  /// computed using the algorithm described in [RFC6979 § 3.2].
+  ///
+  /// [RFC6979 § 3.2]: https://tools.ietf.org/html/rfc6979#section-3
+  ///
+  /// Although deterministic ECDSA signing is typically slower than
+  /// signing with an RNG, it prevents accidental nonce-reuse due to
+  /// a weak RNG.
   @Override
   public byte[] sign(byte[] data) {
     var digest = new SHA256Digest();
     digest.update(data, 0, data.length);
     var hash = new byte[digest.getDigestSize()];
     digest.doFinal(hash, 0);
 
-    var signer = new ECDSASigner();
+    ECDSASigner signer;
+    if (deterministicNonce) {
+      signer = new ECDSASigner(new HMacDSAKCalculator(new SHA256Digest()));
+    } else {
+      signer = new ECDSASigner();
+    }
+
     signer.init(true, privateKey.engineGetKeyParameters());
     var sig = signer.generateSignature(hash);
 

src/main/java/org/eclipse/biscuit/token/Biscuit.java

@@ -353,7 +353,13 @@ public Biscuit attenuate(final SecureRandom rng, final KeyPair keypair, Block bl
   /** Generates a third party block request from a token */
   public Biscuit appendThirdPartyBlock(PublicKey externalKey, ThirdPartyBlockContents blockResponse)
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
-    UnverifiedBiscuit b = super.appendThirdPartyBlock(externalKey, blockResponse);
+    return appendThirdPartyBlock(externalKey, blockResponse, new SecureRandom());
+  }
+
+  public Biscuit appendThirdPartyBlock(
+      PublicKey externalKey, ThirdPartyBlockContents blockResponse, SecureRandom rng)
+      throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
+    UnverifiedBiscuit b = super.appendThirdPartyBlock(externalKey, blockResponse, rng);
 
     // no need to verify again, we are already working from a verified token
     return Biscuit.fromSerializedBiscuit(b.serializedBiscuit, b.symbolTable);

src/main/java/org/eclipse/biscuit/token/UnverifiedBiscuit.java

@@ -272,14 +272,20 @@ public ThirdPartyBlockRequest thirdPartyRequest() {
   public UnverifiedBiscuit appendThirdPartyBlock(
       PublicKey externalKey, ThirdPartyBlockContents blockResponse)
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
+    return appendThirdPartyBlock(externalKey, blockResponse, new SecureRandom());
+  }
+
+  public UnverifiedBiscuit appendThirdPartyBlock(
+      PublicKey externalKey, ThirdPartyBlockContents blockResponse, SecureRandom rng)
+      throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
     SignedBlock previousBlock;
     if (this.serializedBiscuit.getBlocks().isEmpty()) {
       previousBlock = this.serializedBiscuit.getAuthority();
     } else {
       previousBlock =
           this.serializedBiscuit.getBlocks().get(this.serializedBiscuit.getBlocks().size() - 1);
     }
-    KeyPair nextKeyPair = KeyPair.generate(previousBlock.getKey().getAlgorithm());
+    KeyPair nextKeyPair = KeyPair.generate(previousBlock.getKey().getAlgorithm(), rng);
     byte[] payload =
         BlockSignatureBuffer.generateExternalBlockSignaturePayloadV1(
             blockResponse.getPayload(),

src/test/java/org/eclipse/biscuit/crypto/SignatureTest.java

@@ -18,14 +18,24 @@
 import org.eclipse.biscuit.error.Error;
 import org.eclipse.biscuit.error.Result;
 import org.eclipse.biscuit.token.Biscuit;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 /**
  * @serial exclude
  */
 public class SignatureTest {
+  private SecureRandom rng;
+
+  @BeforeEach
+  public void setUp() throws NoSuchAlgorithmException {
+    byte[] seed = {0, 0, 0, 0};
+    rng = SecureRandom.getInstance("SHA1PRNG");
+    rng.setSeed(seed);
+  }
+
   @Test
-  public void testSerialize() throws Error.FormatError {
+  public void testSerialize() throws Error.FormatError, NoSuchAlgorithmException {
     prTestSerialize(Schema.PublicKey.Algorithm.Ed25519, 32);
     prTestSerialize(
         // compressed - 0x02 or 0x03 prefix byte, 32 bytes for X coordinate
@@ -86,11 +96,8 @@ void testInvalidEd25519PublicKey() {
         () -> PublicKey.load(Schema.PublicKey.Algorithm.Ed25519, "badkey".getBytes()));
   }
 
-  private static void prTestSerialize(
-      Schema.PublicKey.Algorithm algorithm, int expectedPublicKeyLength) throws Error.FormatError {
-    byte[] seed = {1, 2, 3, 4};
-    SecureRandom rng = new SecureRandom(seed);
-
+  private void prTestSerialize(Schema.PublicKey.Algorithm algorithm, int expectedPublicKeyLength)
+      throws Error.FormatError, NoSuchAlgorithmException {
     KeyPair keypair = KeyPair.generate(algorithm, rng);
     PublicKey pubkey = keypair.getPublicKey();
 
@@ -112,11 +119,8 @@ private static void prTestSerialize(
     assertEquals(pubkey.toHex(), deserializedPublicKey.toHex());
   }
 
-  private static void prTestThreeMessages(Schema.PublicKey.Algorithm algorithm)
+  private void prTestThreeMessages(Schema.PublicKey.Algorithm algorithm)
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     String message1 = "hello";
     KeyPair root = KeyPair.generate(algorithm, rng);
     KeyPair keypair2 = KeyPair.generate(algorithm, rng);

src/test/java/org/eclipse/biscuit/token/AuthorizerTest.java

@@ -22,10 +22,19 @@
 import org.eclipse.biscuit.error.Error.Parser;
 import org.eclipse.biscuit.token.builder.Expression;
 import org.eclipse.biscuit.token.builder.Term;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 public class AuthorizerTest {
   final RunLimits runLimits = new RunLimits(500, 100, Duration.ofMillis(500));
+  private SecureRandom rng;
+
+  @BeforeEach
+  public void setUp() throws Exception {
+    byte[] seed = {0, 0, 0, 0};
+    rng = SecureRandom.getInstance("SHA1PRNG");
+    rng.setSeed(seed);
+  }
 
   @Test
   public void testAuthorizerPolicy() throws Parser {
@@ -51,8 +60,7 @@ public void testAuthorizerPolicy() throws Parser {
 
   @Test
   public void testPuttingSomeFactsInBiscuitAndGettingThemBackOutAgain() throws Exception {
-
-    KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, new SecureRandom());
+    KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
 
     Biscuit token =
         Biscuit.builder(keypair)
@@ -84,7 +92,7 @@ public void testPuttingSomeFactsInBiscuitAndGettingThemBackOutAgain() throws Exc
 
   @Test
   public void testDatalogAuthorizer() throws Exception {
-    KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, new SecureRandom());
+    KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
 
     Biscuit token =
         Biscuit.builder(keypair)

src/test/java/org/eclipse/biscuit/token/BiscuitTest.java

@@ -37,15 +37,23 @@
 import org.eclipse.biscuit.error.LogicError;
 import org.eclipse.biscuit.token.builder.Block;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 public class BiscuitTest {
 
+  private SecureRandom rng;
+
+  @BeforeEach
+  public void setUp() throws NoSuchAlgorithmException {
+    byte[] seed = {0, 0, 0, 0};
+    rng = SecureRandom.getInstance("SHA1PRNG");
+    rng.setSeed(seed);
+  }
+
   @Test
   public void testBasic()
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
 
     System.out.println("preparing the authority block");
 
@@ -177,9 +185,6 @@ public void testBasic()
 
   @Test
   public void testFolders() throws NoSuchAlgorithmException, Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -288,10 +293,7 @@ public void testMultipleAttenuation()
   }
 
   @Test
-  public void testReset() throws Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
+  public void testReset() throws Error, NoSuchAlgorithmException {
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -361,10 +363,7 @@ public void testReset() throws Error {
   }
 
   @Test
-  public void testEmptyAuthorizer() throws Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
+  public void testEmptyAuthorizer() throws Error, NoSuchAlgorithmException {
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -405,9 +404,6 @@ public void testEmptyAuthorizer() throws Error {
   @Test
   public void testBasicWithNamespaces()
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -535,9 +531,6 @@ public void testBasicWithNamespaces()
   @Test
   public void testBasicWithNamespacesWithAddAuthorityFact()
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -664,9 +657,6 @@ public void testBasicWithNamespacesWithAddAuthorityFact()
   @Test
   public void testRootKeyId()
       throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, Error {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);
@@ -739,9 +729,6 @@ public Optional<PublicKey> getRootKey(Optional<Integer> keyId) {
   @Test
   public void testCheckAll()
       throws Error, NoSuchAlgorithmException, SignatureException, InvalidKeyException {
-    byte[] seed = {0, 0, 0, 0};
-    SecureRandom rng = new SecureRandom(seed);
-
     System.out.println("preparing the authority block");
 
     KeyPair root = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, rng);

src/test/java/org/eclipse/biscuit/token/NondeterministicEcdsaTest.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2019 Geoffroy Couprie <contact@geoffroycouprie.com> and Contributors to the Eclipse Foundation.
+ *  SPDX-License-Identifier: Apache-2.0
+ */
+
+package org.eclipse.biscuit.token;
+
+import static org.eclipse.biscuit.token.builder.Utils.fact;
+import static org.eclipse.biscuit.token.builder.Utils.str;
+
+import biscuit.format.schema.Schema;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.SignatureException;
+import java.util.List;
+import org.eclipse.biscuit.crypto.KeyPair;
+import org.eclipse.biscuit.error.Error;
+import org.eclipse.biscuit.token.builder.Block;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.Isolated;
+
+/** Top-level test to ensure ECDSA with nondeterministic nonce also works. */
+@Isolated
+public class NondeterministicEcdsaTest {
+  @BeforeAll
+  static void beforeAll() {
+    KeyPair.setSECP256R1Factory(KeyPair.DEFAULT_NONDETERMINISTIC_SECP256R1_FACTORY);
+  }
+
+  @AfterAll
+  static void afterAll() {
+    KeyPair.setSECP256R1Factory(KeyPair.DEFAULT_SECP256R1_FACTORY);
+  }
+
+  @Test
+  public void simpleSigningTest()
+      throws Error, NoSuchAlgorithmException, SignatureException, InvalidKeyException {
+    var root = KeyPair.generate(Schema.PublicKey.Algorithm.SECP256R1);
+    var b =
+        Biscuit.make(
+            new SecureRandom(),
+            root,
+            new Block().addFact(fact("foo", List.of(str("bar")))).build());
+    Biscuit.fromBytes(b.serialize(), root.getPublicKey());
+  }
+}