search

secure-systems-lab / securesystemslib

Cryptographic and general-purpose routines for Secure Systems Lab projects at NYU
MIT License
48 stars 49 forks source link

Document detailed signature format per signing scheme #587

Open lukpueh opened 1 year ago

lukpueh commented 1 year ago

The tuf/in-toto signature metadata format specification treats the exact signature format as implementation detail. The (tuf spec) only says that the signature field contains a:

A hex-encoded signature of the canonical form of the metadata for

For the sake of interoperability -- i.e. 3rd-party signature verification or generation of signatures generated by or to be verified by securesystemslib -- the Signer API should document the exact signature format per signing scheme, e.g. for "ecdsa-sha2-nistp256" and "ecdsa-sha2-nistp384":

"ASN.1 encoded Dss-Sig-Value sequences (RFC 3279)"

Note that the documentation should be available per scheme and not per signer, because securesystemslib may implement different signers that generate signatures for the same schemes. E.g. ecdsa signatures can be generated on HSM and in memory.

lukpueh commented 8 months ago

... documentation should be available per scheme ...

Maybe this could be included with docstrings for scheme constants #593