1492621 - add ed25519 cot-artifact-signing to generic-worker

Status: RESOLVED DUPLICATE of bug 1518913

(Taskcluster :: Workers, enhancement)

Description

[Aki Sasaki (not active)]

Once we resolve bug 1492617, we can start signing cot artifacts with ecdsa keys. Hopefully this is relatively straightforward with the ecdsa golang module: https://golang.org/pkg/crypto/ecdsa/ .

Comment 1

[Pete Moore [:pmoore][:pete]]

Hi Aki. I think this bug is done, are you happy for me to close it?

One thing I noticed is that the private key file we get from generic-worker new-ed25519-keypair <FILE> is 44 chars of base64, which I guess is a 256 bit key? (44 * 6 = 264). Is that the intended key size?

Thanks!

Comment 2

[Pete Moore [:pmoore][:pete]]

Also, should the bug title say "ed25519" or "ecdsa"? I'm wondering now if this bug is about replacing ed25519 for ecdsa, or whether the chosen algorithm just changed after bug creation and we just need to update the bug title...

Thanks!

Comment 3

[Aki Sasaki (not active)]

(In reply to Pete Moore [:pmoore][:pete] from comment #1)

Hi Aki. I think this bug is done, are you happy for me to close it?

This is a dup of bug 1518913... we were planning on ecdsa originally, and then switched in this thread.

One thing I noticed is that the private key file we get from generic-worker new-ed25519-keypair <FILE> is 44 chars of base64, which I guess is a 256 bit key? (44 * 6 = 264). Is that the intended key size?

Yes. It's a 32 byte seed that results in a 64 byte key. It's tiny compared to gpg, faster, and yet more secure, because of the elliptical curve algorithm used. I base64 encode the 32byte public- and private- key portions for easier portability, which results in 44 chars of base64. Docker worker uses a 64 byte key rather than a 32 byte seed due to the tweetnacl.js implementation of ed25519, but I've checked for compatibility -- scriptworker can verify its signatures.

Comment 4

[Aki Sasaki (not active)]

• compared to rsa, i supose :)