Add helper to get padded ec signature (#701)

Author: DmitriyMusatkin

awscrt/crypto.py

@@ -286,6 +286,16 @@ def decode_der_signature(signature: bytes) -> ECRawSignature:
         (r, s) = _awscrt.ec_decode_signature(signature)
         return ECRawSignature(r=r, s=s)
 
+    @staticmethod
+    def decode_der_signature_to_padded_pair(signature: bytes, pad_to: int) -> bytes:
+        """
+        Decodes ec signature into padded r || s.
+        Both r and s are padded to the specified value and then concatenated.
+        Typical format for jwt use case.
+        Note: pad_to typically should equal to coord size. e.g 32 for P256 or 48 for P384
+        """
+        return _awscrt.ec_decode_signature_to_padded_pair(signature, pad_to)
+
     @staticmethod
     def encode_raw_signature(signature: ECRawSignature) -> bytes:
         """

crt/aws-c-cal

@@ -859,6 +859,35 @@ PyObject *aws_py_ec_decode_signature(PyObject *self, PyObject *args) {
     return result;
 }
 
+PyObject *aws_py_ec_decode_signature_to_padded_pair(PyObject *self, PyObject *args) {
+    (void)self;
+
+    Py_ssize_t pad_to;
+    struct aws_byte_cursor signature_cur;
+    if (!PyArg_ParseTuple(args, "y#n", &signature_cur.ptr, &signature_cur.len, &pad_to)) {
+        return NULL;
+    }
+
+    if (pad_to > 256) {
+        aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
+        return PyErr_AwsLastError();
+    }
+
+    struct aws_allocator *allocator = aws_py_get_allocator();
+    size_t buf_size = pad_to * 2;
+    struct aws_byte_buf result_buf;
+    aws_byte_buf_init(&result_buf, allocator, buf_size);
+
+    if (aws_ecc_decode_signature_der_to_raw_padded(allocator, signature_cur, &result_buf, pad_to)) {
+        aws_byte_buf_clean_up_secure(&result_buf);
+        return PyErr_AwsLastError();
+    }
+
+    PyObject *ret = PyBytes_FromStringAndSize((const char *)result_buf.buffer, result_buf.len);
+    aws_byte_buf_clean_up_secure(&result_buf);
+    return ret;
+}
+
 PyObject *aws_py_ec_get_public_coords(PyObject *self, PyObject *args) {
     (void)self;
 

source/crypto.c

@@ -53,6 +53,7 @@ PyObject *aws_py_ec_sign(PyObject *self, PyObject *args);
 PyObject *aws_py_ec_verify(PyObject *self, PyObject *args);
 PyObject *aws_py_ec_encode_signature(PyObject *self, PyObject *args);
 PyObject *aws_py_ec_decode_signature(PyObject *self, PyObject *args);
+PyObject *aws_py_ec_decode_signature_to_padded_pair(PyObject *self, PyObject *args);
 PyObject *aws_py_ec_get_public_coords(PyObject *self, PyObject *args);
 
 #endif /* AWS_CRT_PYTHON_CRYPTO_H */

source/crypto.h

@@ -852,6 +852,7 @@ static PyMethodDef s_module_methods[] = {
     AWS_PY_METHOD_DEF(ec_verify, METH_VARARGS),
     AWS_PY_METHOD_DEF(ec_encode_signature, METH_VARARGS),
     AWS_PY_METHOD_DEF(ec_decode_signature, METH_VARARGS),
+    AWS_PY_METHOD_DEF(ec_decode_signature_to_padded_pair, METH_VARARGS),
     AWS_PY_METHOD_DEF(ec_get_public_coords, METH_VARARGS),
 
     /* Checksum primitives */

source/module.c

@@ -2,7 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0.
 
 
-from awscrt.io import LogLevel, init_logging
 from test import NativeResourceTest
 from awscrt.crypto import Hash, RSA, RSAEncryptionAlgorithm, RSASignatureAlgorithm, ED25519, ED25519ExportFormat, EC, ECType, ECRawSignature
 import base64
@@ -388,6 +387,25 @@ def test_ec_asn1_signing_roundtrip(self):
 
         self.assertTrue(ec.verify(digest, signature))
 
+    def test_ec_signature_decode_pair(self):
+
+        signature = bytes([0x30, 0x42, 0x02, 0x1f, 0x2d, 0x2a, 0xad, 0xce, 0xbc, 0x1b, 0x3f, 0x78,
+                           0xec, 0xd1, 0x12, 0x53, 0x9e, 0xc0, 0xe3, 0x44, 0x7b, 0x37, 0x5f, 0x6a,
+                           0x99, 0xca, 0x0b, 0x27, 0xb5, 0x4c, 0x31, 0xda, 0x0e, 0x6c, 0x5e, 0x02,
+                           0x1f, 0x47, 0xfb, 0x3d, 0xbd, 0xff, 0xb8, 0x58, 0xf4, 0xba, 0x8a, 0x03,
+                           0xe7, 0xb4, 0x83, 0xe6, 0xb8, 0xc9, 0x46, 0xa8, 0x0a, 0xd8, 0x46, 0xfa,
+                           0x80, 0x0a, 0xd8, 0xca, 0xc5, 0x3f, 0x8e, 0xbd])
+
+        padded_sig = EC.decode_der_signature_to_padded_pair(signature=signature, pad_to=32)
+
+        expected_sig = bytes([0x00, 0x2d, 0x2a, 0xad, 0xce, 0xbc, 0x1b, 0x3f, 0x78, 0xec, 0xd1, 0x12, 0x53,
+                              0x9e, 0xc0, 0xe3, 0x44, 0x7b, 0x37, 0x5f, 0x6a, 0x99, 0xca, 0x0b, 0x27, 0xb5,
+                              0x4c, 0x31, 0xda, 0x0e, 0x6c, 0x5e, 0x00, 0x47, 0xfb, 0x3d, 0xbd, 0xff, 0xb8,
+                              0x58, 0xf4, 0xba, 0x8a, 0x03, 0xe7, 0xb4, 0x83, 0xe6, 0xb8, 0xc9, 0x46, 0xa8,
+                              0x0a, 0xd8, 0x46, 0xfa, 0x80, 0x0a, 0xd8, 0xca, 0xc5, 0x3f, 0x8e, 0xbd])
+
+        self.assertEqual(padded_sig, expected_sig)
+
 
 if __name__ == '__main__':
     unittest.main()