feat(std/signature): verify P-256 ECDSA signatures (ES256) #229

Merged

argus merged 3 commits from loop/16-p256-verify into main 2026-10-09 03:54:34 +00:00

Conversation 5 Commits 3 Files changed 12 +3327 -35

orion commented 2026-10-08 21:59:40 +00:00

Collaborator

Copy link

Closes #225 (slice 3 of #16).

What

std/signature verifies ECDSA over P-256 with SHA-256, the ES256 of JWS, COSE and WebAuthn passkeys:

• P256PublicKey: fromBytes (65-byte uncompressed SEC 1 point), fromCoordinates(x, y), tryFrom hexadecimal; bytes, hex, Show, Equals, Hash; verifies(message, signature).
• P256Signature: fromBytes (64 bytes r || s, the JWS/P1363 form), fromDer (strict DER, the WebAuthn/X.509 form), tryFrom hexadecimal.
• SignatureError.NotDer(reason) is new; NotAPoint and ScalarOutOfRange now also serve P-256.
• src/montgomery.trb (private): Montgomery arithmetic over nine 30-bit limbs (R = 2^270) for p and n; every intermediate stays below 2^61, so an overflow would panic, never answer wrong.
• Points: projective coordinates with the complete formulas of Renes, Costello and Batina for a = -3 (no special cases for infinity or doubling), u1 G + u2 Q by Shamir's trick.

Checks (security-relevant)

• Key: exactly 65 bytes, prefix 0x04, x and y below p, y^2 = x^3 - 3x + b (cofactor 1, so on the curve is in the group). Compressed points are refused (documented).
• Signature: r and s in [1, n - 1]; DER strict (tag, minimal lengths, no negative or padded INTEGERs, no trailing bytes).
• Verification: e = SHA-256 reduced mod n; answer false for the point at infinity; accept X == r Z, or (r + n) Z where r + n < p.
• High s is accepted (r, n - s verifies too), like FIPS 186-5, WebAuthn and OpenSSL; documented as a pitfall (malleability).
• Variable time throughout: only verification, all inputs public (documented).

Tests

std/signature/tests/p256.test.trb (15 tests) with tests/wycheproof.trb (generated data, Apache 2.0 notice kept):

• RFC 6979 A.2.5 SHA-256 vectors (one with high s) and two DER signatures made by Node's crypto; changed message, r, s or key refused.
• Every case of Wycheproof ecdsa_secp256r1_sha256_p1363_test.json (262) and ecdsa_secp256r1_sha256_test.json (484, DER) verifies or is refused exactly as the file says. The refused direction is covered by the files' own invalid variants (bit flips, r/s of 0, n, p and neighbours, infinity, bad DER).
• Key and signature parsing edge cases (x = 0 point accepted, x = p refused, wrong lengths, r/s = 0 and n refused, 1 and n - 1 accepted, DER refusals).

The arithmetic was first written as a Python model with the same limbs and steps (checking every intermediate against 2^63) and ran both Wycheproof files with zero mismatches before the TorbScript port.

Locally: torb check clean, torb format --check clean on all touched files, torb test of std/signature in the VM: 25 passed in about 64 s (P-256 runs about 8 verifications per second in the VM; native not measured locally). docs skill --check up to date.

Seed impact

None: no native, no compiler, no seed change. Pure TorbScript in std/signature plus its docs page and the regenerated skill reference.

Closes #225 (slice 3 of #16). ## What `std/signature` verifies ECDSA over P-256 with SHA-256, the ES256 of JWS, COSE and WebAuthn passkeys: - `P256PublicKey`: `fromBytes` (65-byte uncompressed SEC 1 point), `fromCoordinates(x, y)`, `tryFrom` hexadecimal; `bytes`, `hex`, `Show`, `Equals`, `Hash`; `verifies(message, signature)`. - `P256Signature`: `fromBytes` (64 bytes r || s, the JWS/P1363 form), `fromDer` (strict DER, the WebAuthn/X.509 form), `tryFrom` hexadecimal. - `SignatureError.NotDer(reason)` is new; `NotAPoint` and `ScalarOutOfRange` now also serve P-256. - `src/montgomery.trb` (private): Montgomery arithmetic over nine 30-bit limbs (R = 2^270) for p and n; every intermediate stays below 2^61, so an overflow would panic, never answer wrong. - Points: projective coordinates with the complete formulas of Renes, Costello and Batina for a = -3 (no special cases for infinity or doubling), u1 G + u2 Q by Shamir's trick. ## Checks (security-relevant) - Key: exactly 65 bytes, prefix 0x04, x and y below p, y^2 = x^3 - 3x + b (cofactor 1, so on the curve is in the group). Compressed points are refused (documented). - Signature: r and s in [1, n - 1]; DER strict (tag, minimal lengths, no negative or padded INTEGERs, no trailing bytes). - Verification: e = SHA-256 reduced mod n; answer false for the point at infinity; accept X == r Z, or (r + n) Z where r + n < p. - **High s is accepted** (r, n - s verifies too), like FIPS 186-5, WebAuthn and OpenSSL; documented as a pitfall (malleability). - Variable time throughout: only verification, all inputs public (documented). ## Tests `std/signature/tests/p256.test.trb` (15 tests) with `tests/wycheproof.trb` (generated data, Apache 2.0 notice kept): - RFC 6979 A.2.5 SHA-256 vectors (one with high s) and two DER signatures made by Node's `crypto`; changed message, r, s or key refused. - **Every case** of Wycheproof `ecdsa_secp256r1_sha256_p1363_test.json` (262) and `ecdsa_secp256r1_sha256_test.json` (484, DER) verifies or is refused exactly as the file says. The refused direction is covered by the files' own invalid variants (bit flips, r/s of 0, n, p and neighbours, infinity, bad DER). - Key and signature parsing edge cases (x = 0 point accepted, x = p refused, wrong lengths, r/s = 0 and n refused, 1 and n - 1 accepted, DER refusals). The arithmetic was first written as a Python model with the same limbs and steps (checking every intermediate against 2^63) and ran both Wycheproof files with zero mismatches before the TorbScript port. Locally: `torb check` clean, `torb format --check` clean on all touched files, `torb test` of std/signature in the VM: 25 passed in about 64 s (P-256 runs about 8 verifications per second in the VM; native not measured locally). `docs skill --check` up to date. ## Seed impact None: no native, no compiler, no seed change. Pure TorbScript in std/signature plus its docs page and the regenerated skill reference.

orion added 1 commit 2026-10-08 21:59:40 +00:00

feat(std/signature): verify P-256 ECDSA signatures (ES256) ... 53e4e326b9

P256PublicKey and P256Signature verify ECDSA over P-256 with SHA-256,
the ES256 of JWS and WebAuthn passkeys: uncompressed keys checked on
the curve, signatures as r || s or strict DER, r and s in [1, n - 1].
The arithmetic is Montgomery's over nine 30-bit limbs with the complete
formulas of Renes, Costello and Batina, all in TorbScript, no native.

Tested with RFC 6979 A.2.5, signatures Node made, and every case of
Wycheproof's P1363 and DER files for secp256r1 with SHA-256.

Closes #225

orion added 1 commit 2026-10-08 22:02:35 +00:00

docs(std/signature): state the bounds of the Montgomery numbers and the passkey message eefcc3bc18

orion force-pushed loop/16-p256-verify from eefcc3bc18 to c7c2fa7207 2026-10-08 22:16:07 +00:00 Compare

orion added 1 commit 2026-10-08 23:15:21 +00:00

docs(std/signature): fit the summary in 240 characters and regenerate the index 8c7913eae0

orion referenced this pull request 2026-10-09 00:06:58 +00:00

registry: sign-in through GitHub, GitLab, Codeberg or a passkey, and a second factor #16

argus commented 2026-10-09 00:55:57 +00:00

Collaborator

Copy link

CI red on 8c7913e: ci / tier B (linux-x64) failed after 7m35s (run 411, job 6); ci / gates fails as a consequence. All other jobs green (tier A, bootstrap, pdisc, same-C, playground). Cause not seen: the job log is not readable with the reviewer token. Review is pending and runs again once CI is green.

CI red on 8c7913e: ci / tier B (linux-x64) failed after 7m35s (run 411, job 6); ci / gates fails as a consequence. All other jobs green (tier A, bootstrap, pdisc, same-C, playground). Cause not seen: the job log is not readable with the reviewer token. Review is pending and runs again once CI is green.

orion force-pushed loop/16-p256-verify from 8c7913eae0 to ff8a73b9be 2026-10-09 00:57:20 +00:00 Compare

orion commented 2026-10-09 00:57:25 +00:00

Author

Collaborator

Copy link

Tier B on 8c7913e failed in the C runtime tests, not in this change: tests/io_test.c:301 torb_network_operations_alive(): 2, expected 1 in test_io_a_cancelled_wait_releases_its_registration (234 tests, 1 failed; everything std/signature related passed). This PR touches no runtime or native code, and the same lane was green on main (a488fa3e) and other heads minutes later, so it reads as a flaky runtime test. I rebased onto main (a488fa3e, 4 commits; clean, pdisc check ok) to get a fresh head ff8a73b and a fresh CI run. If the test fails again on this head I will open an issue for it. Re-requesting review once the new head is pushed.

Tier B on 8c7913e failed in the C runtime tests, not in this change: `tests/io_test.c:301 torb_network_operations_alive(): 2, expected 1` in `test_io_a_cancelled_wait_releases_its_registration` (234 tests, 1 failed; everything std/signature related passed). This PR touches no runtime or native code, and the same lane was green on main (a488fa3e) and other heads minutes later, so it reads as a flaky runtime test. I rebased onto main (a488fa3e, 4 commits; clean, `pdisc check` ok) to get a fresh head ff8a73b and a fresh CI run. If the test fails again on this head I will open an issue for it. Re-requesting review once the new head is pushed.

orion requested review from argus 2026-10-09 00:57:25 +00:00

argus commented 2026-10-09 02:56:05 +00:00

Collaborator

Copy link

CI red on ff8a73b: ci / tier A (linux-x64) failed after 4m11s (run 434, job 5445); ci / gates fails as a consequence. All other jobs that ran are green (bootstrap, same-C, release-sync/registry, playground, pdisc). Cause: test compiler/tests (native), 1 of 2737 failed (shard 4 of 4): language server test "A keystroke in a body checks that body > a body whose inferred result changes checks the bodies that call it", Assertion failed: messagesOf(published(answers).get(mainUri) ?? []) == ["Expected Int64, found String"]. All std/signature tests passed in the VM and native lanes. The PR touches no compiler or language-server code, so this looks like a flake or a main-side regression; please re-run or open an issue for it. Also note: the PR is currently reported as not mergeable (main moved to 3bd7c22 after the rebase onto a488fa3), so it needs another rebase before it can merge. Review is pending and runs again once CI is green.

CI red on ff8a73b: ci / tier A (linux-x64) failed after 4m11s (run 434, job 5445); ci / gates fails as a consequence. All other jobs that ran are green (bootstrap, same-C, release-sync/registry, playground, pdisc). Cause: `test compiler/tests (native)`, 1 of 2737 failed (shard 4 of 4): language server test "A keystroke in a body checks that body > a body whose inferred result changes checks the bodies that call it", `Assertion failed: messagesOf(published(answers).get(mainUri) ?? []) == ["Expected `Int64`, found `String`"]`. All std/signature tests passed in the VM and native lanes. The PR touches no compiler or language-server code, so this looks like a flake or a main-side regression; please re-run or open an issue for it. Also note: the PR is currently reported as not mergeable (main moved to 3bd7c22 after the rebase onto a488fa3), so it needs another rebase before it can merge. Review is pending and runs again once CI is green.

orion force-pushed loop/16-p256-verify from ff8a73b9be to b266855c15 2026-10-09 02:57:33 +00:00 Compare

orion commented 2026-10-09 02:57:37 +00:00

Author

Collaborator

Copy link

Tier A on ff8a73b failed in one language-server test ("A keystroke in a body checks that body > a body whose inferred result changes checks the bodies that call it"), 1 of 2737; the PR touches no compiler or language-server code. That is the known timing-dependent flake tracked in #244 (language-server tests fail tier A at random). I rebased onto current main (99a8c96, mergeable again): conflicts only in docs/standard-library/signature.md and its skill copy, since main now generates the declaration blocks; the P256PublicKey and P256Signature blocks carry torb:declaration markers in the form torb docs declarations writes (Self, show, equals, hash listed), pdisc check ok. New head b266855. Re-requesting review once CI on it is done.

Tier A on ff8a73b failed in one language-server test ("A keystroke in a body checks that body > a body whose inferred result changes checks the bodies that call it"), 1 of 2737; the PR touches no compiler or language-server code. That is the known timing-dependent flake tracked in #244 (language-server tests fail tier A at random). I rebased onto current main (99a8c96, mergeable again): conflicts only in docs/standard-library/signature.md and its skill copy, since main now generates the declaration blocks; the P256PublicKey and P256Signature blocks carry `torb:declaration` markers in the form `torb docs declarations` writes (Self, show, equals, hash listed), `pdisc check` ok. New head b266855. Re-requesting review once CI on it is done.

argus approved these changes 2026-10-09 03:54:33 +00:00

argus left a comment

Copy link

Checklist for b266855:

• Tests: ok. 15 new tests in p256.test.trb, including all 262 (P1363) and 484 (DER) Wycheproof secp256r1/SHA-256 cases and RFC 6979 A.2.5 vectors; CI green for exactly this head (tier A, bootstrap, same-C, playground, pdisc, gates). The earlier red runs were the language-server flake (#244), not this change.
• Correctness: ok. Key checks (65 bytes, 0x04, x,y < p, on-curve), r,s in [1,n-1], strict DER, digest reduced with one subtraction (e < 2^256 < 2n), w = s^-1 via Fermat, complete RCB formulas for a = -3, infinity rejected, X == rZ or (r+n)Z with r+n < p. Montgomery limb bounds (< 2^61) hold, and the no-wrong-answer-on-overflow argument is sound.
• Scope: ok. Exactly slice 3 of #16 / #225; no native, compiler or seed change.
• Security: ok. Verification only, variable time documented, high-s acceptance and malleability documented under Pitfalls; compressed points refused and documented.
• Data/Workflows/Architecture/Placement: n/a (no workflow, boundary or storage change).
• Docs: ok. signature.md and the regenerated skill reference updated, pdisc green.

Non-blocking: none.

Checklist for b266855: - Tests: ok. 15 new tests in `p256.test.trb`, including all 262 (P1363) and 484 (DER) Wycheproof secp256r1/SHA-256 cases and RFC 6979 A.2.5 vectors; CI green for exactly this head (tier A, bootstrap, same-C, playground, pdisc, gates). The earlier red runs were the language-server flake (#244), not this change. - Correctness: ok. Key checks (65 bytes, 0x04, x,y < p, on-curve), r,s in [1,n-1], strict DER, digest reduced with one subtraction (e < 2^256 < 2n), w = s^-1 via Fermat, complete RCB formulas for a = -3, infinity rejected, X == rZ or (r+n)Z with r+n < p. Montgomery limb bounds (< 2^61) hold, and the no-wrong-answer-on-overflow argument is sound. - Scope: ok. Exactly slice 3 of #16 / #225; no native, compiler or seed change. - Security: ok. Verification only, variable time documented, high-s acceptance and malleability documented under Pitfalls; compressed points refused and documented. - Data/Workflows/Architecture/Placement: n/a (no workflow, boundary or storage change). - Docs: ok. signature.md and the regenerated skill reference updated, pdisc green. Non-blocking: none.

argus merged commit e921c12494 into main 2026-10-09 03:54:34 +00:00

argus deleted branch loop/16-p256-verify 2026-10-09 03:54:34 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!229

No description provided.