Add delegated signing seam#59
Draft
aidangarske wants to merge 1 commit into
Draft
Conversation
1 task
There was a problem hiding this comment.
Pull request overview
Adds an opt-in “delegated/external signing” seam so callers can provide a signature callback (e.g., TF-M / PSA / HSM-backed keys) and keep private key material outside of wolfCOSE, integrating this into COSE_Sign1 and COSE_Sign.
Changes:
- Introduces
WOLFCOSE_ENABLE_EXT_SIGN→WOLFCOSE_EXT_SIGNbuild-time gate and publicWOLFCOSE_SIGN_CBcallback type. - Adds
wc_CoseKey_SetExtSigner()and plumbs the callback-driven signing path intowc_CoseSign1_Sign()andwc_CoseSign_Sign(). - Extends failure-injection points to cover external signer failures.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/force_failure.h | Adds a failure-injection enum for external signer callbacks. |
| src/wolfcose.c | Implements delegated signing, callback invocation, and integrates it into Sign1/Sign signing flows. |
| src/wolfcose_internal.h | Declares internal wolfCose_ExtSign() helper under the feature gate. |
| include/wolfcose/wolfcose.h | Adds public callback typedef, extends WOLFCOSE_KEY (feature-gated), and exports wc_CoseKey_SetExtSigner(). |
| include/wolfcose/settings.h | Adds the opt-in configuration macro and a build-time sanity check for signing enablement. |
Comment on lines
+3607
to
+3615
| /* ECDSA is fixed-width r||s (RFC 9053 Section 2.1); a short or long | ||
| * signature here would produce a malformed COSE message. */ | ||
| if ((ret == WOLFCOSE_SUCCESS) && (key->kty == WOLFCOSE_KTY_EC2)) { | ||
| ret = wolfCose_CrvKeySize(key->crv, &coordSz); | ||
|
|
||
| if ((ret == WOLFCOSE_SUCCESS) && (*sigLen != (2u * coordSz))) { | ||
| ret = WOLFCOSE_E_CRYPTO; | ||
| } | ||
| } |
Comment on lines
+4656
to
+4665
| #if defined(WOLFCOSE_EXT_SIGN) | ||
| if ((ret == WOLFCOSE_SUCCESS) && (signer->key->signCb != NULL)) { | ||
| size_t extSigLen = 0; | ||
|
|
||
| /* Signature goes after the Sig_structure in scratch; sigBuf is | ||
| * reserved for the local-signing branches. */ | ||
| if (scratchSz <= sigStructLen) { | ||
| ret = WOLFCOSE_E_BUFFER_TOO_SMALL; | ||
| } | ||
| if (ret == WOLFCOSE_SUCCESS) { |
Comment on lines
+3536
to
+3546
| switch (alg) { | ||
| case WOLFCOSE_ALG_EDDSA: | ||
| case WOLFCOSE_ALG_ML_DSA_44: | ||
| case WOLFCOSE_ALG_ML_DSA_65: | ||
| case WOLFCOSE_ALG_ML_DSA_87: | ||
| preHashes = 0; | ||
| break; | ||
| default: | ||
| preHashes = 1; | ||
| break; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
WOLFCOSE_ENABLE_EXT_SIGN, letting a caller supply a signature callback so the private key never enters wolfCOSE. Needed for TF-M, where the attestation key stays in the crypto partition and signing goes overpsa_sign_hash. Useful for any HSM backed key.Wired into both
wc_CoseSign1_Signandwc_CoseSign_Sign. With a callback set,rngmay be NULL.Off by default.
src/wolfcose.ois byte identical when disabled (verified withcmp), +792 B when enabled.Testing: full suite passes with the feature on and off. Verified end to end in TF-M v2.3.0 on QEMU mps2-an521, where the tf-m-tests regression suite passes 200/0, matching stock t_cose, and real t_cose verifies the wolfCOSE produced token. Paired OSP patch adds the TF-M side.