[xmlsec] ECDSA signature verification

[Timothy Legge]

Hi

I have been working on adding ECDSA signature support to perl XML::Sig
and I have been able to able to get the following XML::Sig signed XML
to verify with:

xmlsec1 --verify --pubkey-pem t/ecdsa.public.pem --id-attr:ID "foo" ec.xml

Can xmlsec1 verify an ecdsa signed file without specifying the
--pubkey-pem t/ecdsa.public.pem option.  Basically reading the
ECKeyValue and recreating the public key similar to the method that
DSA signed xml can be verified.

Actually, I guess it appears that RFC 4050 compatable <dsig:KeyValue>
is not supported
https://github.com/lsh123/xmlsec/blob/db3d277c55d8e8c15fcdc0dad6a9d4e912c6d13d/src/openssl/evp.c#L1111

So, is there a format for ECKeyValue that is supported to validate the
xml with a public key format provided in the file?  The docs seem to
indicate https://www.w3.org/TR/xmldsig-core1/#sec-ECKeyValue that:

<ECKeyValue xmlns="http://www.w3.org/2009/xmldsig11#">
  <NamedCurve URI="urn:oid:1.2.840.10045.3.1.7" />
  <PublicKey>
    vWccUP6Jp3pcaMCGIcAh3YOev4gaa2ukOANC7Ufg
    Cf8KDO7AtTOsGJK7/TA8IC3vZoCy9I5oPjRhyTBulBnj7Y
  </PublicKey>
</ECKeyValue>

Is that supported?

regards

Tim

t/ecdsa.public.pem:

-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEs69DU1vn+KLrY1KCigCexfPMFKLVD5hc
JT12cIHaJUCfkvW1VlW/fQ7xBTB6DQ1427kJ28xiumaj4T53oKPPWgVnbcsiwrvG
IrFF0fX9D5AjZfpVmp8RTuF92T1FGMdM
-----END PUBLIC KEY-----

ec.xml:

<?xml version="1.0"?>
<foo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" ID="123"><dsig:Signature>
            <dsig:SignedInfo xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                <dsig:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
                <dsig:SignatureMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
                <dsig:Reference URI="#123">
                        <dsig:Transforms>
                            <dsig:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <dsig:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </dsig:Transforms>
                        <dsig:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>

<dsig:DigestValue>48PJcCfbr1m88CtkExCvcDd22eQ=</dsig:DigestValue>
                    </dsig:Reference>
            </dsig:SignedInfo>
            <dsig:SignatureValue>XsSae8/xLbVOav9JASSFzWIVL96fkxXpbYKrJICzrQ0W/1xRFMpC7oIY9c51N7J3epHgNrcRm7wl
6dpui6HG2Bl4/KH+YN5ZjfttDIyRs99dh4Dv7ih/KYSqqn0n+PFF
</dsig:SignatureValue>
            <dsig:KeyInfo>
                             <dsig:KeyValue>
                                <dsig:ECKeyValue>
                                    <dsig:DomainParameters>
                                        <dsig:NamedCurve
URN="urn:oid:1.3.132.0.34"/>
                                    </dsig:DomainParameters>
                                    <dsig:PublicKey>
                                        <dsig:X
Value="s69DU1vn+KLrY1KCigCexfPMFKLVD5hcJT12cIHaJUCfkvW1VlW/fQ7xBTB6DQ14
"/>
                                        <dsig:Y
Value="27kJ28xiumaj4T53oKPPWgVnbcsiwrvGIrFF0fX9D5AjZfpVmp8RTuF92T1FGMdM
"/>
                                    </dsig:PublicKey>
                                </dsig:ECKeyValue>
                             </dsig:KeyValue>
                            </dsig:KeyInfo>
        </dsig:Signature></foo>