Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ed25519 pkcs8/pem has a wrong format #457

Open
ninegua opened this issue Aug 16, 2023 · 0 comments
Open

Ed25519 pkcs8/pem has a wrong format #457

ninegua opened this issue Aug 16, 2023 · 0 comments

Comments

@ninegua
Copy link
Member

ninegua commented Aug 16, 2023

Just want to make a note that using ring::signature::Ed25519KeyPair::generate_pkcs8() has a bug that creates wrongly formatted pkcs8 strings or PEMs. See this thread for more details briansmith/ring#1464.

What it means for us:

  1. Ed25519 PEMs created from dfx cannot be parsed by other standard tools or libraries (e.g. Rust library pkcs8). This likely only affects pems generated from old dfx versions because we have switched to using Secp256k1 as the default.
  2. It seems that dfx or ic-agent cannot parse properly formatted ed25519 pkcs8 v2 strings or PEM files. This may require a fix depending on how urgent we think it is. PKCS8 v2 / PEM format for ed25519 is in a sorry state, because standard tools like openssl has yet to support it Add support for PKCS#8 v2 (RFC 5958 - Asymmetric Key Packages) openssl/openssl#10468.

Maybe other people have better suggestions?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant