[Botan-devel] Solved! Botan Patch inside Re: potential problem with 'GOST 3410-2001' parameters, or with my code

bert hubert bert.hubert at netherlabs.nl
Thu Jan 27 11:01:00 EST 2011


On Thu, Jan 27, 2011 at 10:31:33AM -0500, Jack Lloyd wrote:
> Do you know of any existing GOST test cases which consist of:
> 
> A wire-format (ie octet string, or X.509 cert) key
> A wire-format signature
> A wire-format message

The best case I know comes from RFC 5933 itself. Let me know if the below is
crisp & concise enough, I could work on this a bit more to tighten it up if
need be.

The PEM format key in all its little-endian horror (you need to linewrap the
GostAsn1 field from paragraph 2.2 a bit to get this file):

-----BEGIN PRIVATE KEY-----
MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgQg/9MiXtXKg9FD
XDN/R9CmVhJDyuzRAIgh4tPwCu4NHIs=
-----END PRIVATE KEY-----

This corresponds to x =
62921053811209831477801257617359308896207289893386294529012781006682251777023

The unhashed original comes from:
"www.example.net. 3600 IN A 192.0.2.1"

The GOST R34.11 hash that is derived from the packed version of this
original:

MZ4PMD6Q8fjcUkfz7yrz9onmngpM/yuKS0u3jFct8pA=

The 64 byte signature from the RFC:
7vzzz6iLOmvtjs5FjVjSHT8XnRKFY15ki6KpkNPkUnS8iIns0Kv4APT+D9ibmHhGri6Sfbyyzi67
+wBbbW/jrA==

This is encoded in DNSSEC RRSIG format as:
www.example.net. 3600 IN RRSIG A 12 3 3600 20300101000000 (
                                    20000101000000 59732 example.net.
                                    7vzzz6iLOmvtjs5FjVjSHT8XnRKFY15ki6Kp
                                    kNPkUnS8iIns0Kv4APT+D9ibmHhGri6Sfbyy
                                    zi67+wBbbW/jrA== )

Here a signature made with a patched Botan:
Zu0JwKbJfiLLTma8ph0ggv32kk86cXxDtTGy1D/udtuw9JCnkBsAnM34clLr4XkKmrGmpETbrKPiZK8h0Ytegw==

Openssl also verifies this one as correct.

> anymore so I don't know what happened; it's quite possible I wrote the
> signature serialization portion myself and made the error there, then
> replicated the buggy behavior into botan.

It is easy enough to encode 'r,s' in that order and not as 's,r'.. One can
take little-endian too far it appears ;-)

	Bert



More information about the botan-devel mailing list