fix(sign): keep unbounded hashing and signing from starving the async executor - #183
Conversation
… executor (TOB-SIGSTORE-8) Trail of Bits finding TOB-SIGSTORE-8 (informational, denial of service): Signer::sign synchronously hashed and ECDSA-signed unbounded Artifact::Bytes input inside an async fn, so a large artifact could occupy an executor worker thread for its entire duration and starve other tasks. KeyPair::sign additionally hashed the full message a second time inside aws-lc-rs before producing the signature. Mechanism: - sigstore-crypto grows KeyPair::sign_prehashed(Sha256Hasher), built on aws-lc-rs EcdsaKeyPair::sign_digest. It signs the incrementally computed SHA-256 digest directly, producing a signature that verifies equivalently to ECDSA-SHA256 over the raw message while making the signing step O(1) in the message size (and dropping the SystemRandom handle the full-message path constructs). - sigstore-sign hashes caller-controlled input (artifact bytes and DSSE PAE bytes) in 64 KiB chunks without materializing a full PAE copy, yielding to the executor between chunks via a small runtime-agnostic yield_now future (no new dependency, works on any executor), then signs the precomputed digest. - Signer::sign and Signer::sign_raw_statement document the behavior; statement JSON validation stays synchronous since statements carry metadata, not artifact contents. Tests cover chunked-vs-one-shot digest equivalence and that prehashed signatures verify as ECDSA-SHA256 over the full message. Signed-off-by: Wolf Vollprecht <w.vollprecht@gmail.com>
wolfv
changed the title
|
Preserving the discussion from earlier PR
|
2 participants
Summary
Fixes TOB-SIGSTORE-8: unbounded artifact hashing and ECDSA signing no longer monopolize an async executor thread or hash the same input twice.
Stack
Supersedes #169.
Signed-off-by: Wolf Vollprecht w.vollprecht@gmail.com