rfc6979: initial crate (#409)

Splits out the RFC6979 deterministic nonce generation so it can
(eventually) be used for DSA as well as ECDSA.

The implementation is generic over a `Digest` as well as a `UInt` type
as defined by `crypto-bigint`.

It's also `no_std` friendly and avoids making heap allocations.

Cargo.toml

@@ -1,3 +1,7 @@
 [workspace]
 resolver = "2"
-members = ["ecdsa", "ed25519"]
+members = [
+    "ecdsa",
+    "ed25519",
+    "rfc6979"
+]

ecdsa/Cargo.toml

@@ -2,25 +2,25 @@
 name    = "ecdsa"
 version = "0.13.0-pre" # Also update html_root_url in lib.rs when bumping this
 description = """
-Signature and elliptic curve types providing interoperable support for the
-Elliptic Curve Digital Signature Algorithm (ECDSA)
+Pure Rust implementation of the Elliptic Curve Digital Signature Algorithm
+(ECDSA) as specified in FIPS 186-4 (Digital Signature Standard)
 """
 authors = ["RustCrypto Developers"]
 license = "Apache-2.0 OR MIT"
-repository = "https://github.com/RustCrypto/signatures"
+repository = "https://github.com/RustCrypto/signatures/tree/master/ecdsa"
 readme = "README.md"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "ecc", "nist", "secp256k1", "signature"]
 edition = "2021"
 rust-version = "1.56"
 
 [dependencies]
-elliptic-curve = { version = "0.11", default-features = false, features = ["sec1"] }
-hmac = { version = "0.11", optional = true, default-features = false }
-signature = { version = ">= 1.3.1", default-features = false, features = ["rand-preview"] }
+elliptic-curve = { version = "0.11.1", default-features = false, features = ["sec1"] }
+signature = { version = ">= 1.3.1, <1.5", default-features = false, features = ["rand-preview"] }
 
 # optional dependencies
 der = { version = "0.5", optional = true }
+rfc6979 = { version = "0", optional = true, path = "../rfc6979" }
 
 [dev-dependencies]
 elliptic-curve = { version = "0.11", default-features = false, features = ["dev"] }
@@ -37,7 +37,7 @@ hazmat = []
 pkcs8 = ["elliptic-curve/pkcs8", "der"]
 pem = ["elliptic-curve/pem", "pkcs8"]
 serde = ["elliptic-curve/serde"]
-sign = ["arithmetic", "digest", "hazmat", "hmac"]
+sign = ["arithmetic", "digest", "hazmat", "rfc6979"]
 std = ["alloc", "elliptic-curve/std", "signature/std"]
 verify = ["arithmetic", "digest", "hazmat"]
 

ecdsa/README.md

@@ -1,4 +1,4 @@
-# RustCrypto: ECDSA
+# [RustCrypto]: ECDSA
 
 [![crate][crate-image]][crate-link]
 [![Docs][docs-image]][docs-link]
@@ -57,8 +57,12 @@ dual licensed as above, without any additional terms or conditions.
 [rustc-image]: https://img.shields.io/badge/rustc-1.56+-blue.svg
 [chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg
 [chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260048-signatures
-[build-image]: https://github.com/RustCrypto/signatures/workflows/ecdsa/badge.svg?branch=master&event=push
-[build-link]: https://github.com/RustCrypto/signatures/actions?query=workflow%3Aecdsa
+[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/ecdsa.yml/badge.svg
+[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/ecdsa.yml
+
+[//]: # (links)
+
+[RustCrypto]: https://github.com/RustCrypto
 
 [//]: # (footnotes)
 

ecdsa/src/lib.rs

@@ -69,10 +69,6 @@ pub mod dev;
 #[cfg_attr(docsrs, doc(cfg(feature = "hazmat")))]
 pub mod hazmat;
 
-#[cfg(feature = "sign")]
-#[cfg_attr(docsrs, doc(cfg(feature = "sign")))]
-pub mod rfc6979;
-
 #[cfg(feature = "sign")]
 mod sign;
 
@@ -87,13 +83,17 @@ pub use elliptic_curve::{self, sec1::EncodedPoint, PrimeCurve};
 // Re-export the `signature` crate (and select types)
 pub use signature::{self, Error, Result};
 
+#[cfg(feature = "rfc6979")]
+#[cfg_attr(docsrs, doc(cfg(feature = "rfc6979")))]
+pub use rfc6979;
+
 #[cfg(feature = "sign")]
 #[cfg_attr(docsrs, doc(cfg(feature = "sign")))]
-pub use sign::SigningKey;
+pub use crate::sign::SigningKey;
 
 #[cfg(feature = "verify")]
 #[cfg_attr(docsrs, doc(cfg(feature = "verify")))]
-pub use verify::VerifyingKey;
+pub use crate::verify::VerifyingKey;
 
 use core::{
     fmt::{self, Debug},

ecdsa/src/sign.rs

@@ -13,7 +13,9 @@ use elliptic_curve::{
     ops::{Invert, Reduce},
     subtle::{Choice, ConstantTimeEq},
     zeroize::Zeroize,
-    FieldBytes, FieldSize, NonZeroScalar, PrimeCurve, ProjectiveArithmetic, Scalar, SecretKey,
+    zeroize::Zeroizing,
+    FieldBytes, FieldSize, NonZeroScalar, PrimeCurve, ProjectiveArithmetic, Scalar, ScalarCore,
+    SecretKey,
 };
 use signature::{
     digest::{BlockInput, Digest, FixedOutput, Reset, Update},
@@ -176,8 +178,17 @@ where
     /// computed using the algorithm described in RFC 6979 (Section 3.2):
     /// <https://tools.ietf.org/html/rfc6979#section-3>
     fn try_sign_digest(&self, msg_digest: D) -> Result<Signature<C>> {
-        let k = rfc6979::generate_k(&self.inner, msg_digest.clone(), &[]);
+        let x = Zeroizing::new(ScalarCore::<C>::from(self.inner));
         let msg_scalar = Scalar::<C>::from_be_bytes_reduced(msg_digest.finalize_fixed());
+        let k = Zeroizing::new(
+            NonZeroScalar::<C>::from_uint(*rfc6979::generate_k::<D, _>(
+                x.as_uint(),
+                &C::ORDER,
+                &msg_scalar.to_repr(),
+                &[],
+            ))
+            .unwrap(),
+        );
         Ok(self.inner.try_sign_prehashed(**k, msg_scalar)?.0)
     }
 }
@@ -209,11 +220,20 @@ where
         mut rng: impl CryptoRng + RngCore,
         msg_digest: D,
     ) -> Result<Signature<C>> {
-        let mut added_entropy = FieldBytes::<C>::default();
-        rng.fill_bytes(&mut added_entropy);
+        let mut entropy = FieldBytes::<C>::default();
+        rng.fill_bytes(&mut entropy);
 
-        let k = rfc6979::generate_k(&self.inner, msg_digest.clone(), &added_entropy);
+        let x = Zeroizing::new(ScalarCore::<C>::from(self.inner));
         let msg_scalar = Scalar::<C>::from_be_bytes_reduced(msg_digest.finalize_fixed());
+        let k = Zeroizing::new(
+            NonZeroScalar::<C>::from_uint(*rfc6979::generate_k::<D, _>(
+                x.as_uint(),
+                &C::ORDER,
+                &msg_scalar.to_repr(),
+                &entropy,
+            ))
+            .unwrap(),
+        );
         Ok(self.inner.try_sign_prehashed(**k, msg_scalar)?.0)
     }
 }

ed25519/README.md

@@ -1,4 +1,4 @@
-# RustCrypto: Ed25519
+# [RustCrypto]: Ed25519
 
 [![crate][crate-image]][crate-link]
 [![Docs][docs-image]][docs-link]
@@ -57,7 +57,11 @@ dual licensed as above, without any additional terms or conditions.
 [build-image]: https://github.com/RustCrypto/signatures/workflows/ed25519/badge.svg?branch=master&event=push
 [build-link]: https://github.com/RustCrypto/signatures/actions?query=workflow%3Aed25519
 
-[//]: # (general links)
+[//]: # (links)
+
+[RustCrypto]: https://github.com/RustCrypto
+
+[//]: # (footnotes)
 
 [1]: https://en.wikipedia.org/wiki/EdDSA
 [2]: https://tools.ietf.org/html/rfc8032

rfc6979/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

rfc6979/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name    = "rfc6979"
+version = "0.0.0" # Also update html_root_url in lib.rs when bumping this
+description = """
+Pure Rust implementation of RFC6979: Deterministic Usage of the
+Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)
+"""
+authors = ["RustCrypto Developers"]
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/RustCrypto/signatures/tree/master/rfc6979"
+readme = "README.md"
+categories = ["cryptography", "no-std"]
+keywords = ["dsa", "ecdsa", "signature"]
+edition = "2021"
+rust-version = "1.56"
+
+[dependencies]
+crypto-bigint = { version = "0.3", default-features = false, features = ["generic-array", "zeroize"] }
+hmac = { version = "0.11", default-features = false }
+zeroize = { version = "1", default-features = false }
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]