[erlang PR猎人] Implement support for ECDSA certificates in TLS 1.3 #2286

此 PR 在 TLS1.3 版本中加入了对 ECDSA 证书的支持. 可以看到新的代码中注释由

%% TODO: Add support for EC and RSA-SSA signatures

变成了

%% TODO: Add support for ed25519, ed448, rsa_pss*

然后是在 signature_algorithm_to_scheme/1 函数里添加了以下 clauses. 很有趣的一点是可能考虑到兼容性问题, 除了在原有的sha1WithRSAEncryption 基础上又添加了 'sha-1WithRSAEncryption':

signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'ecdsa-with-SHA256'}) ->
    ecdsa_secp256r1_sha256;
signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'ecdsa-with-SHA384'}) ->
    ecdsa_secp384r1_sha384;
signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'ecdsa-with-SHA512'}) ->
    ecdsa_secp512r1_sha512;
signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'sha-1WithRSAEncryption'}) ->
    rsa_pkcs1_sha1;
...
signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'ecdsa-with-SHA1'}) ->
    ecdsa_sha1.

之后在tls_handshake_1_3模块里对 sign 和 verify 函数加入了 ECDSA 的支持. 可以看到在 sign 和 verify 的时候都会先对 Context 做 THash 处理, 这里的 THash 不是 ECDSA 签名过程中要用到的 HashAlgo :

sign(THash, Context, HashAlgo, #'ECPrivateKey'{} = PrivateKey) ->
    Content = build_content(Context, THash),
    try public_key:sign(Content, HashAlgo, PrivateKey) of
        Signature ->
            {ok, Signature}
    catch
        error:badarg ->
            {error, badarg}
    end;
    
...

verify(THash, Context, HashAlgo, Signature, {?'id-ecPublicKey', PublicKey, PublicKeyParams}) ->
    Content = build_content(Context, THash),
    try public_key:verify(Content, HashAlgo, Signature, {PublicKey, PublicKeyParams}) of
        Result ->
            {ok, Result}
    catch
        error:badarg ->
            {error, badarg}
    end;
verify(THash, Context, HashAlgo, Signature, {?rsaEncryption, PublicKey, _PubKeyParams}) ->

最后就是使用 ssl_test_lib 模块来进行测试. 总的来说, 这个 PR 的内容是比较简单的, 借助 public_key模块中的功能实现了 TLS 的 ECDSA 证书支持.