Skip to content

Unable to build certificate with P384 from version 0.3.0 #2403

Description

@Firstyear

A number of type/trait changes have occured with 0.3.0. Notably, this has broken certificate building with ECDSA P384 Signing keys.

Consider:

let int_cert = builder
        .build::<_, DerSignature>(&root_signing_key)
        .expect("failed to build intermediate CA certificate");

Where root_signing_key is of the type SigningKey<NistP384>

This yields the following errors:

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: ecdsa::signature::Signer<ecdsa::der::Signature<NistP384>>` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `ecdsa::signature::Signer<ecdsa::der::Signature<NistP384>>` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: `ecdsa::SigningKey<C>` implements trait `ecdsa::signature::Signer<S>`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/signing.rs:180:1
    |
180 | / impl<C> Signer<Signature<C>> for SigningKey<C>
181 | | where
182 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
183 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<ecdsa::Signature<C>>`
...
282 | / impl<C> Signer<SignatureWithOid<C>> for SigningKey<C>
283 | | where
284 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
285 | |     C::Digest: AssociatedOid,
286 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<SignatureWithOid<C>>`
...
321 | / impl<C> Signer<der::Signature<C>> for SigningKey<C>
322 | | where
323 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
324 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
325 | |     der::MaxSize<C>: ArraySize,
326 | |     <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
    | |__________________________________________________________________________^ `ecdsa::signature::Signer<ecdsa::der::Signature<C>>`
    |
   ::: /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/recovery.rs:283:1
    |
283 | / impl<C> Signer<(Signature<C>, RecoveryId)> for SigningKey<C>
284 | | where
285 | |     C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
286 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^ `ecdsa::signature::Signer<(ecdsa::Signature<C>, RecoveryId)>`
note: required by a bound in `build`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-cert-0.3.0/src/builder.rs:291:12
    |
289 |     fn build<S, Signature>(mut self, signer: &S) -> Result<Self::Output>
    |        ----- required by a bound in this associated function
290 |     where
291 |         S: Signer<Signature>,
    |            ^^^^^^^^^^^^^^^^^ required by this bound in `Builder::build`

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: Keypair` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `KeypairRef` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: the trait `KeypairRef` is implemented for `ecdsa::SigningKey<C>`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.17.0/src/signing.rs:568:1
    |
568 | / impl<C> KeypairRef for SigningKey<C>
569 | | where
570 | |     C: EcdsaCurve + CurveArithmetic,
571 | |     Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    | |____________________________________________________^
    = note: required for `&ecdsa::SigningKey<NistP384>` to implement `Keypair`
note: required by a bound in `build`
   --> /Users/william/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/x509-cert-0.3.0/src/builder.rs:292:12
    |
289 |     fn build<S, Signature>(mut self, signer: &S) -> Result<Self::Output>
    |        ----- required by a bound in this associated function
...
292 |         S: Keypair + DynSignatureAlgorithmIdentifier,
    |            ^^^^^^^ required by this bound in `Builder::build`

error[E0277]: the trait bound `&ecdsa::SigningKey<NistP384>: DynSignatureAlgorithmIdentifier` is not satisfied
   --> src/test_ca.rs:307:18
    |
307 |         .build::<_, DerSignature>(&root_signing_key)
    |          -----   ^ the trait `SignatureAlgorithmIdentifier` is not implemented for `&ecdsa::SigningKey<NistP384>`
    |          |
    |          required by a bound introduced by this call
    |
help: the trait `SignatureAlgorithmIdentifier` is implemented for `ecdsa::SigningKey<C>`

The causes P385 certificate signers to fail to compile. Given the complexity of the types and traits involved I haven't been able to resolve this for a few hours :(

My assumption is that there are either missing traits or something silly that is being missed here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions