2064306 - HPKE P-256 and P-384 KEMs

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P2)

Description

[Martin Thomson [:mt:]]

The P-256 and P-384 DH KEM variants of HPKE are somewhat widely used. Implementation is also fairly straightforward. The code was generally structured in a way that was easy to extend with a new (DH) KEM.

For the mainline code, the only problem was that the HPKE code was not consistently using the right key types for X25519. In the interests of backward/ABI compatibility, the code now tolerates keys that are created with ecKey AND ecMontKey as their type. A new test is added that confirms this. This results in about a third of the overall diff.

The bulk of the changes here are tests. Test vectors, sourced from HPKE updates, are added. These don't include the secret key used by the sender, which meant that slight restructuring was necessary. This produces most of the rest of the diff.

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 2064306 - HPKE P-256 and P-384 KEMs r=jschanck

This adds support for the two common NIST EC curves as DH KEMs in HPKE.

This also ensures that it is possible to generate an X25519 key using
either CKM_EC_KEY_PAIR_GEN and CKM_EC_MONTGOMERY_KEY_PAIR_GEN.
That will be tagged as an ecKey or ecMontKey respectively.
Prior to this, only the first (ecKey) form was accepted.
As PK11_GenerateKeyPair is properly invoked with the latter in
many places, including the nss-rs crate, this was causing issues.

Comment 2

[BugBot [:suhaib / :marco]]

There is an r+ patch which didn't land and no activity in this bug for 1 week.
:mt, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/e29c1ed7efa8
HPKE P-256 and P-384 KEMs r=nss-reviewers,jschanck

Comment 4

[John Schanck [:jschanck]]

Attachment: Bug 2064306 - avoid VLA in tls_ech_unittest.cc. r=mt

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/ceab23409b6d
avoid VLA in tls_ech_unittest.cc. r=mt