@@ -424,6 +424,17 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
424424 final override ConsumerInputDataFlowNode getInputNode ( ) { result = inputNode }
425425 }
426426
427+ final private class SignatureArtifactConsumer extends ArtifactConsumerAndInstance {
428+ ConsumerInputDataFlowNode inputNode ;
429+
430+ SignatureArtifactConsumer ( ) {
431+ exists ( SignatureOperationInstance op | inputNode = op .getSignatureConsumer ( ) ) and
432+ this = Input:: dfn_to_element ( inputNode )
433+ }
434+
435+ final override ConsumerInputDataFlowNode getInputNode ( ) { result = inputNode }
436+ }
437+
427438 /**
428439 * An artifact that is produced by an operation, representing a concrete artifact instance rather than a synthetic consumer artifact.
429440 */
@@ -458,6 +469,8 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
458469 }
459470
460471 override DataFlowNode getOutputNode ( ) { result = creator .getOutputArtifact ( ) }
472+
473+ KeyOperationInstance getCreator ( ) { result = creator }
461474 }
462475
463476 /**
@@ -782,6 +795,17 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
782795 abstract ArtifactOutputDataFlowNode getOutputArtifact ( ) ;
783796 }
784797
798+ /**
799+ * A key operation instance representing a signature being generated or verified.
800+ */
801+ abstract class SignatureOperationInstance extends KeyOperationInstance {
802+ /**
803+ * Gets the consumer of the signature that is being verified in case of a
804+ * verification operation.
805+ */
806+ abstract ConsumerInputDataFlowNode getSignatureConsumer ( ) ;
807+ }
808+
785809 /**
786810 * A key-based algorithm instance used in cryptographic operations such as encryption, decryption,
787811 * signing, verification, and key wrapping.
@@ -1266,6 +1290,7 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
12661290 TNonceInput ( NonceArtifactConsumer e ) or
12671291 TMessageInput ( MessageArtifactConsumer e ) or
12681292 TSaltInput ( SaltArtifactConsumer e ) or
1293+ TSignatureInput ( SignatureArtifactConsumer e ) or
12691294 TRandomNumberGeneration ( RandomNumberGenerationInstance e ) { e .flowsTo ( _) } or
12701295 // Key Creation Operation union type (e.g., key generation, key load)
12711296 TKeyCreationOperation ( KeyCreationOperationInstance e ) or
@@ -1327,14 +1352,14 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
13271352 /**
13281353 * Returns the child of this node with the given edge name.
13291354 *
1330- * This predicate is overriden by derived classes to construct the graph of cryptographic operations.
1355+ * This predicate is overridden by derived classes to construct the graph of cryptographic operations.
13311356 */
13321357 NodeBase getChild ( string edgeName ) { none ( ) }
13331358
13341359 /**
13351360 * Defines properties of this node by name and either a value or location or both.
13361361 *
1337- * This predicate is overriden by derived classes to construct the graph of cryptographic operations.
1362+ * This predicate is overridden by derived classes to construct the graph of cryptographic operations.
13381363 */
13391364 predicate properties ( string key , string value , Location location ) { none ( ) }
13401365
@@ -1507,6 +1532,20 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
15071532 override LocatableElement asElement ( ) { result = instance }
15081533 }
15091534
1535+ /**
1536+ * A signature input. This may represent a signature, or a signature component
1537+ * such as the scalar values r and s in ECDSA.
1538+ */
1539+ final class SignatureArtifactNode extends ArtifactNode , TSignatureInput {
1540+ SignatureArtifactConsumer instance ;
1541+
1542+ SignatureArtifactNode ( ) { this = TSignatureInput ( instance ) }
1543+
1544+ final override string getInternalType ( ) { result = "SignatureInput" }
1545+
1546+ override LocatableElement asElement ( ) { result = instance }
1547+ }
1548+
15101549 /**
15111550 * A salt input.
15121551 */
@@ -1530,13 +1569,22 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
15301569
15311570 KeyOperationOutputNode ( ) { this = TKeyOperationOutput ( instance ) }
15321571
1533- final override string getInternalType ( ) { result = "KeyOperationOutput" }
1572+ override string getInternalType ( ) { result = "KeyOperationOutput" }
15341573
15351574 override LocatableElement asElement ( ) { result = instance }
15361575
15371576 override string getSourceNodeRelationship ( ) { none ( ) }
15381577 }
15391578
1579+ class SignOperationOutputNode extends KeyOperationOutputNode {
1580+ SignOperationOutputNode ( ) {
1581+ this .asElement ( ) .( KeyOperationOutputArtifactInstance ) .getCreator ( ) .getKeyOperationSubtype ( ) =
1582+ TSignMode ( )
1583+ }
1584+
1585+ override string getInternalType ( ) { result = "SignatureOutput" }
1586+ }
1587+
15401588 /**
15411589 * A source of random number generation.
15421590 */
@@ -2109,6 +2157,7 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
21092157 }
21102158
21112159 class SignatureOperationNode extends KeyOperationNode {
2160+ override SignatureOperationInstance instance ;
21122161 string nodeName ;
21132162
21142163 SignatureOperationNode ( ) {
@@ -2118,6 +2167,21 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
21182167 }
21192168
21202169 override string getInternalType ( ) { result = nodeName }
2170+
2171+ SignatureArtifactNode getASignatureArtifact ( ) {
2172+ result .asElement ( ) = instance .getSignatureConsumer ( ) .getConsumer ( )
2173+ }
2174+
2175+ override NodeBase getChild ( string key ) {
2176+ result = super .getChild ( key )
2177+ or
2178+ // [KNOWN_OR_UNKNOWN] - only if we know the type is verify
2179+ this .getKeyOperationSubtype ( ) = TVerifyMode ( ) and
2180+ key = "Signature" and
2181+ if exists ( this .getASignatureArtifact ( ) )
2182+ then result = this .getASignatureArtifact ( )
2183+ else result = this
2184+ }
21212185 }
21222186
21232187 /**
@@ -2565,15 +2629,15 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
25652629 or
25662630 curveName = "CURVE25519" and keySize = 255 and curveFamily = CURVE25519 ( )
25672631 or
2632+ curveName = "CURVE448" and keySize = 448 and curveFamily = CURVE448 ( )
2633+ or
25682634 // TODO: separate these into key agreement logic or sign/verify (ECDSA / ECDH)
25692635 // or
25702636 // curveName = "X25519" and keySize = 255 and curveFamily = CURVE25519()
25712637 // or
25722638 // curveName = "ED25519" and keySize = 255 and curveFamily = CURVE25519()
25732639 // or
25742640 // curveName = "ED448" and keySize = 448 and curveFamily = CURVE448()
2575- // curveName = "CURVE448" and keySize = 448 and curveFamily = CURVE448()
2576- // or
25772641 // or
25782642 // curveName = "X448" and keySize = 448 and curveFamily = CURVE448()
25792643 curveName = "SM2" and keySize in [ 256 , 512 ] and curveFamily = SM2 ( )
0 commit comments