Merge pull request #13 from lestrrat-go/feat-ecdsa-der

add SignECDSADER and VerifyECDSADER helpers

Author: lestrrat

Changes

@@ -1,6 +1,13 @@
 Changes
 =======
 
+v1.2.2 UNRELEASED
+  * Add `SignECDSADER()` and `VerifyECDSADER()` primitive helpers for ECDSA
+    signatures in ASN.1 DER-encoded `Ecdsa-Sig-Value` form (RFC 3279 §2.2.3),
+    as used by X.509/PKIX and composite signature schemes. The existing
+    `SignECDSA()`/`VerifyECDSA()` functions remain the canonical entry points
+    for the JWS-native fixed-length r||s format (RFC 7515 §3.4).
+
 v1.2.1 7 Apr 2026
   * Add `SignDigest()` for signing pre-computed digests. Supported for HMAC,
     RSA (PKCS1v15 and PSS), and ECDSA families. EdDSA and Custom return an error.

ecdsa.go

@@ -124,6 +124,47 @@ func SignECDSA(key *ecdsa.PrivateKey, payload []byte, h crypto.Hash, rr io.Reade
 	return PackECDSASignature(r, s, key.Curve.Params().BitSize)
 }
 
+// SignECDSADER generates an ECDSA signature in ASN.1 DER-encoded Ecdsa-Sig-Value
+// format (RFC 3279 §2.2.3), as required by X.509/PKIX and composite signature
+// schemes such as draft-ietf-lamps-pq-composite-sigs. For the fixed-length
+// JWS r||s format (RFC 7515 §3.4), use SignECDSA instead.
+//
+// The payload is hashed with h before signing. rr provides randomness; if nil,
+// rand.Reader is used.
+func SignECDSADER(key *ecdsa.PrivateKey, payload []byte, h crypto.Hash, rr io.Reader) ([]byte, error) {
+	if !isValidECDSAKey(key) {
+		return nil, fmt.Errorf(`invalid key type %T for ECDSA algorithm`, key)
+	}
+	hh := h.New()
+	if _, err := hh.Write(payload); err != nil {
+		return nil, fmt.Errorf(`failed to write payload using ecdsa: %w`, err)
+	}
+	digest := hh.Sum(nil)
+
+	if rr == nil {
+		rr = rand.Reader
+	}
+
+	sig, err := ecdsa.SignASN1(rr, key, digest)
+	if err != nil {
+		return nil, fmt.Errorf(`failed to sign payload using ecdsa: %w`, err)
+	}
+	return sig, nil
+}
+
+// VerifyECDSADER verifies an ECDSA signature in ASN.1 DER-encoded
+// Ecdsa-Sig-Value format. See SignECDSADER for the format distinction. The
+// payload is hashed with h before verification.
+func VerifyECDSADER(key *ecdsa.PublicKey, payload, signature []byte, h crypto.Hash) error {
+	hh := h.New()
+	hh.Write(payload)
+	digest := hh.Sum(nil)
+	if !ecdsa.VerifyASN1(key, digest, signature) {
+		return NewVerificationError("invalid ECDSA signature")
+	}
+	return nil
+}
+
 // SignECDSACryptoSigner generates an ECDSA signature using a crypto.Signer interface.
 // This function works with hardware security modules and other crypto.Signer implementations.
 // The signature is converted from ASN.1 format to JWS format (r||s).

ecdsa_test.go

@@ -0,0 +1,92 @@
+package dsig_test
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/sha512"
+	"hash"
+	"testing"
+
+	"github.com/lestrrat-go/dsig"
+	"github.com/stretchr/testify/require"
+)
+
+func TestECDSADER(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		curve elliptic.Curve
+		h     crypto.Hash
+		hfunc func() hash.Hash
+	}{
+		{"P256/SHA256", elliptic.P256(), crypto.SHA256, sha256.New},
+		{"P384/SHA384", elliptic.P384(), crypto.SHA384, sha512.New384},
+		{"P521/SHA512", elliptic.P521(), crypto.SHA512, sha512.New},
+	}
+
+	payload := []byte("the quick brown fox jumps over the lazy dog")
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			key, err := ecdsa.GenerateKey(tc.curve, rand.Reader)
+			require.NoError(t, err, "generate key")
+
+			digest := func() []byte {
+				h := tc.hfunc()
+				h.Write(payload)
+				return h.Sum(nil)
+			}
+
+			t.Run("round trip", func(t *testing.T) {
+				sig, err := dsig.SignECDSADER(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSADER")
+				require.NoError(t, dsig.VerifyECDSADER(&key.PublicKey, payload, sig, tc.h), "VerifyECDSADER")
+			})
+
+			t.Run("dsig sign, stdlib verify", func(t *testing.T) {
+				sig, err := dsig.SignECDSADER(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSADER")
+				require.True(t, ecdsa.VerifyASN1(&key.PublicKey, digest(), sig), "stdlib VerifyASN1 must accept dsig DER output")
+			})
+
+			t.Run("stdlib sign, dsig verify", func(t *testing.T) {
+				sig, err := ecdsa.SignASN1(rand.Reader, key, digest())
+				require.NoError(t, err, "ecdsa.SignASN1")
+				require.NoError(t, dsig.VerifyECDSADER(&key.PublicKey, payload, sig, tc.h), "VerifyECDSADER must accept stdlib DER output")
+			})
+
+			t.Run("format isolation", func(t *testing.T) {
+				derSig, err := dsig.SignECDSADER(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSADER")
+				jwsSig, err := dsig.SignECDSA(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSA")
+
+				require.Error(t, dsig.VerifyECDSA(&key.PublicKey, payload, derSig, tc.h), "JWS verifier must reject DER signature")
+				require.Error(t, dsig.VerifyECDSADER(&key.PublicKey, payload, jwsSig, tc.h), "DER verifier must reject JWS signature")
+			})
+
+			t.Run("tamper detection", func(t *testing.T) {
+				sig, err := dsig.SignECDSADER(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSADER")
+				tampered := make([]byte, len(sig))
+				copy(tampered, sig)
+				tampered[len(tampered)/2] ^= 0xFF
+				require.Error(t, dsig.VerifyECDSADER(&key.PublicKey, payload, tampered, tc.h), "tampered signature must fail")
+			})
+
+			t.Run("wrong key", func(t *testing.T) {
+				sig, err := dsig.SignECDSADER(key, payload, tc.h, nil)
+				require.NoError(t, err, "SignECDSADER")
+				other, err := ecdsa.GenerateKey(tc.curve, rand.Reader)
+				require.NoError(t, err, "generate other key")
+				require.Error(t, dsig.VerifyECDSADER(&other.PublicKey, payload, sig, tc.h), "wrong key must fail")
+			})
+		})
+	}
+}