NIST curve P-521 SHA-512 support for generating keys and signing

[est31]

I'd like to have support for ECDSA_P521_SHA512_ASN1_SIGNING signing, DER export and key generation as there already is support for ECDSA_P256_SHA256_ASN1_SIGNING or ECDSA_P384_SHA384_ASN1_SIGNING.

See also: https://tools.ietf.org/html/rfc5480#section-4 for a list of possible combinations.

[briansmith]

@est31 Which software uses p521 SHA-512?

[est31]

Which software uses p521 SHA-512?

I just wanted it for completion. If you don't feel there is a need, feel free to close this.

Openssl supports p521 but it seems to sign using SHA-256. E.g. openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-521 -pkeyopt ec_param_enc:named_curve generates a key but if you use it to sign a csr, it uses a SHA-256 hash. Firefox is at least capable of displaying the key, haven't tested more.

[EvanDarwin]

I would also like this feature, I'm trying to implement a software which is built on p521 SHA-512 and would like to use ring as a crypto library. This is a feature that cfssl does have.

[EvanDarwin]

I would be interested in donating to help get this feature implemented. I went ahead and sent you an email @briansmith.

[obelisk]

SSH keys can be ecdsa-sha2-nistp521 as well

[est31]

ecdsa_secp521r1_sha512 is also one of the supported signature algorithms in TLS 1.3: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.3

[panva]

P-521 is used in JOSE, COSE, as well as supported in Web Cryptography API. Developers may choose to use this curve in a variety of applications for quite some time now.

[palfrey]

It also gets used in Terraform plugin handshake validation which admittedly, are mostly in Go, but I ran into issues recently building one in Rust because of this lack.

[digitwolf]

I think P-521 is also important from the post-quantum perspective.
Are there any thoughts, plans for the implementation?

[josephlr]

I think P-521 is also important from the post-quantum perspective.

Note that P-521 (and all the other standard ECDSA curves) are not quantum resistant. Quantum-resistance will require a completely different signing algorithm (not ECDSA or EdDSA). See https://csrc.nist.gov/projects/post-quantum-cryptography for more information.

[briansmith]

FWIW, When I asked "Which software uses p521 SHA-512?," what I meant was "What software requires you to implement P-521, given that P-256 and P-384 are already available to you?" Of course I know of all the standards that provide ways to use P-521, but I don't know of any popular software that has a P-521-only configuration.

Regardless, I am more open to supporting P-521 (and P-521 SHA-512 signature algorithms) than I was in the past.

Just, I'm surprised so many people care about it. I would expect to find a lot more X448-only software than P-521-only-software.