Add support for ECDSA signatures

Author: tvdijen

src/Alg/Signature/ECDSA.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SimpleSAML\XMLSecurity\Alg\Signature;
+
+use SimpleSAML\XMLSecurity\Constants as C;
+use SimpleSAML\XMLSecurity\Key\AsymmetricKey;
+
+/**
+ * Class implementing the ECDSA signature algorithm.
+ *
+ * @package simplesamlphp/xml-security
+ */
+final class ECDSA extends AbstractSigner implements SignatureAlgorithmInterface
+{
+    /**
+     * RSA constructor.
+     *
+     * @param \SimpleSAML\XMLSecurity\Key\AsymmetricKey $key The asymmetric key (either public or private) to use.
+     * @param string $algId The identifier of this algorithm.
+     */
+    public function __construct(
+        #[\SensitiveParameter]
+        AsymmetricKey $key,
+        string $algId,
+    ) {
+        parent::__construct($key, $algId, C::$ECDSA_DIGESTS[$algId]);
+    }
+
+
+    /**
+     * @return string[]
+     */
+    public static function getSupportedAlgorithms(): array
+    {
+        return array_keys(C::$ECDSA_DIGESTS);
+    }
+}

src/Alg/Signature/SignatureAlgorithmFactory.php

@@ -25,11 +25,12 @@ final class SignatureAlgorithmFactory
     /**
      * An array of blacklisted algorithms.
      *
-     * Defaults to RSA-SHA1, RSAPSS-SHA1 & HMAC-SHA1 due to the weakness of SHA1.
+     * Defaults to ECDSA-SHA1, RSA-SHA1, RSAPSS-SHA1 & HMAC-SHA1 due to the weakness of SHA1.
      *
      * @var string[]
      */
     public const array DEFAULT_BLACKLIST = [
+        C::SIG_ECDSA_SHA1,
         C::SIG_RSA_SHA1,
         C::SIG_RSA_PSS_SHA1,
         C::SIG_HMAC_SHA1,
@@ -41,6 +42,7 @@ final class SignatureAlgorithmFactory
      * @var class-string[]
      */
     private const array SUPPORTED_DEFAULTS = [
+        ECDSA::class,
         RSA::class,
         HMAC::class,
     ];

src/Constants.php

@@ -116,6 +116,15 @@ class Constants extends \SimpleSAML\XML\Constants
 
     public const string SIG_RSA_RIPEMD160 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160';
 
+    /**
+     * ECDSA Signature algorithms
+     */
+    public const string SIG_ECDSA_SHA1 = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1';
+    public const string SIG_ECDSA_SHA224 = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224';
+    public const string SIG_ECDSA_SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256';
+    public const string SIG_ECDSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384';
+    public const string SIG_ECDSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512';
+
     /**
      * HMAC Signature algorithms
      */
@@ -240,6 +249,15 @@ class Constants extends \SimpleSAML\XML\Constants
         self::BLOCK_ENC_AES256_GCM => 16,
     ];
 
+    /** @var array<string, string> */
+    public static array $ECDSA_DIGESTS = [
+        self::SIG_ECDSA_SHA1 => self::DIGEST_SHA1,
+        self::SIG_ECDSA_SHA224 => self::DIGEST_SHA224,
+        self::SIG_ECDSA_SHA256 => self::DIGEST_SHA256,
+        self::SIG_ECDSA_SHA384 => self::DIGEST_SHA384,
+        self::SIG_ECDSA_SHA512 => self::DIGEST_SHA512,
+    ];
+
     /** @var array<string, string> */
     public static array $RSA_DIGESTS = [
         self::SIG_RSA_SHA1 => self::DIGEST_SHA1,

src/XML/ds/SignatureMethod.php

@@ -51,6 +51,7 @@ public function __construct(
         Assert::oneOf(
             $Algorithm->getValue(),
             array_merge(
+                array_keys(C::$ECDSA_DIGESTS),
                 array_keys(C::$RSA_DIGESTS),
                 array_keys(C::$HMAC_DIGESTS),
             ),

tests/XML/SignedElementTest.php

@@ -328,6 +328,41 @@ public function testSuccessfulVerifyingRsaPssSignature(): void
     }
 
 
+    /**
+     * Verify an ECDSA signature
+     */
+    public function testSuccessfulVerifyingEcdsaSignature(): void
+    {
+        // sign using ECDSA_SHA256
+        $customSignable = $this->sign(C::SIG_ECDSA_SHA256);
+        // No-op to _actually_ sign the element and set the signature-property.
+        $customSignable = CustomSignable::fromXML($customSignable->toXML());
+
+        $signature = $customSignable->getSignature();
+
+        $this->assertEquals(
+            C::SIG_ECDSA_SHA256,
+            $signature
+                ->getSignedInfo()
+                ->getSignatureMethod()
+                ->getAlgorithm()
+                ->getValue(),
+        );
+
+        $certificate = new X509Certificate($this->certificate);
+
+        $factory = new SignatureAlgorithmFactory();
+        $verifier = $factory->getAlgorithm(
+            C::SIG_ECDSA_SHA256,
+            $certificate->getPublicKey(),
+        );
+
+        $verified = $customSignable->verify($verifier);
+
+        $this->assertInstanceOf(CustomSignable::class, $verified);
+    }
+
+
     /**
      * Negative: verify a RSA-PSS signature using PKCS#1 v1.5
      */