Unify ring signature/verification constants

[josephlr]

One of the confusing parts of ring::Signature is that the set of supported verification algorithms is not the set of supported signing algorithms. Specifically,

• 8192-bit RSA signatures can be verified, but not created (RSA 8192 is supported only for verification, not for signing #843)
• P384_SHA256 and P256_SHA384 signatures can be verified but not created
  • @npmccallum opened Add more variants of ECDSA / SHA2 signing #801 as an attempt to address this
• 2048-bit RSA SHA384 signatures can be verified with RSA_PKCS1_2048_8192_SHA384 but not with RSA_PKCS1_3072_8192_SHA384.

This difference in support leads to a fairly large API surface in the signature module. I.E.

• RSA_PSS_2048_8192_SHA{256|384|512} and RSA_PSS_SHA{256|384|512}
• ECDSA_P256_SHA256_ASN1 and ECDSA_P256_SHA256_ASN1_SIGNING

My proposal to fix this issue would be to:

• Only support RSA operations up to 4096 bits (second option in RSA 8192 is supported only for verification, not for signing #843 (comment))
• Remove RSA_PKCS1_3072_8192_SHA384 (as it is inconsistent with the rest of the API).
• Remove P256_SHA384 support entirely (I could not find any uses in the wild).
• Add support for P384_SHA256 signing (this is all we need, see Add more variants of ECDSA / SHA2 signing #801 (comment))
• Unify the signing vs. verification algorithm constants. Specifically the following constants would be deprecated and made aliases for their shorter equivalents:
  • ECDSA_P256_SHA256_FIXED_SIGNING
  • ECDSA_P256_SHA256_ASN1_SIGNING
  • ECDSA_P384_SHA384_FIXED_SIGNING
  • ECDSA_P384_SHA384_ASN1_SIGNING
  • RSA_PKCS1_2048_8192_SHA1
  • RSA_PKCS1_2048_8192_SHA256
  • RSA_PKCS1_2048_8192_SHA384
  • RSA_PKCS1_2048_8192_SHA512
  • RSA_PSS_2048_8192_SHA256
  • RSA_PSS_2048_8192_SHA384
  • RSA_PSS_2048_8192_SHA512

Note that this unification would not preclude, for example, having a RSA_PKCS1_SHA1 constant that only supported verification and not signing. It would just allow RSA_PKCS1_SHA256 to work for both verification and singing.

[briansmith]

• 8192-bit RSA signatures can be verified, but not created (RSA 8192 is supported only for verification, not for signing #843)

• P384_SHA256 and P256_SHA384 signatures can be verified but not created

  • @npmccallum opened Add more variants of ECDSA / SHA2 signing #801 as an attempt to address this

• 2048-bit RSA SHA384 signatures can be verified with RSA_PKCS1_2048_8192_SHA384 but not with RSA_PKCS1_3072_8192_SHA384.

Those are all intentional decisions. We support a minimal set of functionality and wait for important use cases to justify expanding the API.

In the case of RSA_PKCS1_3072_8192_SHA384, of course it can't verify a 2048-bit RSA signature; its entire purpose for existing is to enforce a minimum size of 3072 bits.

I'm going to close this issue because it seems to be based on the premise that we should be able to generate every kind of signature that we accept. However, we intentionally don't do that. Some kinds of signatures we accept only for legacy reasons.