Use recommended crypto library to create ECC seed #480
Conversation
yawangwang
force-pushed
the
remove_p224_support
branch
from
a54e004
to
1993889
Compare
|
/gcbrun |
There was a problem hiding this comment.
I am not an expert here, so I'm not sure when someone would want to pick a given curve. However, we should not remove support for the deprecated library given the GCP vTPM supports P224 unless there's a good reason besides the deprecated library.
sudo tpm2_getcap ecc-curves
TPM2_ECC_NIST_P256: 0x3
TPM2_ECC_NIST_P521: 0x5
TPM2_ECC_NIST_P384: 0x4
TPM2_ECC_NIST_P224: 0x2
| @@ -131,25 +132,45 @@ func createECCSeed(ek tpm2.Public) (seed, encryptedSeed []byte, err error) { | |||
| if err != nil { | |||
| return nil, nil, err | |||
| } | |||
| priv, x, y, err := elliptic.GenerateKey(curve, rand.Reader) | |||
|
|
|||
| ecdsaPriv, err := ecdsa.GenerateKey(curve, rand.Reader) | |||
There was a problem hiding this comment.
We're doing ecdh here so you should use the utilities in crypto/ecdh instead
There was a problem hiding this comment.
We need EC points {x, y} to compute ECC seed in the following operations. Using crypto/ecdh utilities is an ideal way, however they don't provide a method to expose the EC points {x, y} in public key.
crypto/ecdsa provides a method to do that, also there are methods which convert each key type to their counterparts in the the ecdh package. See line 141 that converts an ecdsa private key to its corresponding ecdh private key.
I agree to keep the deprecated library till P224 is supported by crypto/ecdh. There is a proposal golang/go#59783 that seeks for this support. So I'll leave this PR open for now. |
yawangwang
changed the title
Per discussions from #471 (comment), remove curve P224 as it is not supported by crypto/ecdh