use ECDSA with SHA256 signers and verifiers for elliptic curve algorithms #8
Description
Please correct me if I'm wrong here, but I've noticed two things that together seem strange:
- The
RSA-SHAxxxhash functions are being used to create the signers and verifiers increateKeySignerandcreateKeyVerifier. createECDSASignerandcreateECDSAVeriferare simply wrappers aroundcreateKeySignerandcreateKeyVerifier, with a single modification to reformat the signature
This leads me to believe that the signers and verifiers are performing signing and verifying with the RSA-SHAxxx hash functions provided by Node's built-in crypto library, when they should be using ECDSA with SHA256.
Is there something I'm missing here? Is there another place where the signers and verifiers are being defined?
I came across an issue when I browserify-ed node-jsonwebtoken and noticed that the signing wasn't working.
Thanks!
Reference code:
function createKeySigner(bits) {
return function sign(thing, privateKey) {
if (!bufferOrString(privateKey) && !(typeof privateKey === 'object'))
throw typeError(MSG_INVALID_SIGNER_KEY);
thing = normalizeInput(thing);
// Even though we are specifying "RSA" here, this works with ECDSA
// keys as well.
const signer = crypto.createSign('RSA-SHA' + bits);
const sig = (signer.update(thing), signer.sign(privateKey, 'base64'));
return base64url.fromBase64(sig);
}
}
function createKeyVerifier(bits) {
return function verify(thing, signature, publicKey) {
if (!bufferOrString(publicKey))
throw typeError(MSG_INVALID_VERIFIER_KEY);
thing = normalizeInput(thing);
signature = base64url.toBase64(signature);
const verifier = crypto.createVerify('RSA-SHA' + bits);
verifier.update(thing);
return verifier.verify(publicKey, signature, 'base64');
}
}
function createECDSASigner(bits) {
const inner = createKeySigner(bits);
return function sign() {
var signature = inner.apply(null, arguments);
signature = formatEcdsa.derToJose(signature, 'ES' + bits);
return signature;
};
}
function createECDSAVerifer(bits) {
const inner = createKeyVerifier(bits);
return function verify(thing, signature, publicKey) {
signature = formatEcdsa.joseToDer(signature, 'ES' + bits).toString('base64');
const result = inner(thing, signature, publicKey);
return result;
};
}