Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support other Public keys than ecdsa when verifying SCT #1240

Closed
vaikas opened this issue Dec 22, 2021 · 2 comments · Fixed by #1241
Closed

Support other Public keys than ecdsa when verifying SCT #1240

vaikas opened this issue Dec 22, 2021 · 2 comments · Fixed by #1241
Labels
enhancement New feature or request

Comments

@vaikas
Copy link
Contributor

vaikas commented Dec 22, 2021

Description

For verifying the SCT cosign seems to assume that public keys are always going to be Elliptical. I also verified that if I spin up an instance of CT Log here:
https://github.com/google/certificate-transparency-go/blob/master/trillian/docs/ManualDeployment.md#key-generation

With RSA keys, then cosign is unable to verify the SCT produced by the CT Log.

The assumption seems to be here:
https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go#L57

And with some debugging magic enabled, it fails:

getting signer: getting key from Fulcio: verifying SCT: cannot verify RSA signature with *ecdsa.PublicKey key

So, I was planning to add other public key types supported for verification.

@vaikas vaikas added the enhancement New feature or request label Dec 22, 2021
@vaikas
Copy link
Contributor Author

vaikas commented Dec 22, 2021

I can't assign to myself, but I'll be happy to work on this.

@dlorenc
Copy link
Member

dlorenc commented Dec 22, 2021

+1!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
2 participants