Truncate digests to the left most bits when signing with ECDSA

[mwielgoszewski]

In Golang's ecdsa signing implementation, digests are truncated to the left most bits to match the bit length of the order of the curve.

If this digest is not truncated, the TPM will return an error parameter 1, error code 0x15 : structure is the wrong size.

This PR updates the signECDSA function to match what Golang does under the hood.

[brandonweeks]

I believe we're using this code and it works for us. How did you encounter the error?

[mwielgoszewski]

I wrote an implementation for certstore for linux that used TPM2 backed keys, and the certstore unit tests caught it:

From https://github.com/github/smimesign/blob/main/certstore/certstore_test.go#L230

sha384Digest := sha512.Sum384([]byte("hello"))
sig, err = signer.Sign(rand.Reader, sha384Digest[:], crypto.SHA384)
if err != nil {
	t.Fatal(err)
}
if err = leafEC.Certificate.CheckSignature(x509.ECDSAWithSHA384, []byte("hello"), sig); err != nil {
	t.Fatal(err)
}

[brandonweeks]

For posterity: this isn't an issue with p256 + sha256, which explains why the bug was not previously discovered.

[brandonweeks]

Thanks!

[mjg59]

This breaks P-256 sha256 signing if the leading byte is 0 - the digest loses the leftmost bit (or bits, if there's multiple 0s in a row)

[mjg59]

I think the correct fix is probably just to re-add as many leading 0s as are necessary to restore the original digest length?

[mjg59]

(Although I don't know if this is correct in the case of a digest longer than the curve length)