Repository navigation
docs(signing): cite the RFC 9421 section that defines ECDSA P-256 - #252
Merged
damaz91 merged 1 commit intoOct 19, 2026
Conversation
The ucp_signing.py module docstring attributes the fixed-width raw r||s
rule for ECDSA P-256 to RFC 9421 Section 3.3.1. That section is RSASSA-PSS
Using SHA-512. ECDSA using curve P-256 and SHA-256 is Section 3.3.4, and
it is the section that defines the encoding the module implements: r and s
"encoded as big-endian unsigned integers, zero-padded to 32 octets each",
concatenated into a 64-octet array.
The substance of the line was already right and the code matches it:
_EC_CURVES maps P-256 to ("ES256", 32) and the verifier rebuilds a DSS
signature from the two 32-byte halves. Only the section number was wrong.
For completeness, the sibling P-384 rule is Section 3.3.5 and EdDSA over
edwards25519 is Section 3.3.6; the line cites RFC 8032 for Ed25519, which
is correct and unchanged.
The same wrong section number appears in the UCP specification at
signatures.md Signature Encoding, which is where this docstring took it
from. That is a separate fix in the spec repo.
Swept the repo for the class: this was the only Section 3.3.x citation in
any .py, .ts, .js or .md file. The Node twin in rest/nodejs/src/utils/
signature.ts cites Section 2.2.3 for authority normalisation, which is
correct, and no 3.3.x section.
Gates: uv sync rc 0; uv run --directory rest/python/server pytest 279
passed, 12 subtests passed, rc 0.
damaz91
added
status:needs-triage
damaz91
approved these changes
Oct 15, 2026
nicholasjameshall
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
ucp_signing.pymodule docstring attributes the fixed-width rawr||srule forECDSA P-256 to RFC 9421 Section 3.3.1. That section is RSASSA-PSS Using SHA-512.
ECDSA using curve P-256 and SHA-256 is Section 3.3.4, and it is the section that
defines the encoding this module implements:
rands"encoded as big-endianunsigned integers, zero-padded to 32 octets each", concatenated into a 64-octet array.
The substance of the line was already right and the code matches it.
_EC_CURVESmapsP-256to("ES256", 32)and the verifier rebuilds a DSS signature from the two32-byte halves. Only the section number was wrong. For completeness the sibling P-384
rule is Section 3.3.5 and EdDSA over edwards25519 is Section 3.3.6; the line cites
RFC 8032 for Ed25519, which is correct and unchanged.
Swept the repo for the class: this is the only Section 3.3.x citation in any
.py,.ts,.jsor.mdfile. The Node twin atrest/nodejs/src/utils/signature.tscitesSection 2.2.3 for authority normalisation, which is correct, and no 3.3.x section.
The UCP specification carries the same number at
signatures.mdSignature Encoding,which is where this docstring took it from when the module was written. That is a
separate fix in the spec repo.
Gates:
uv sync --directory rest/python/server/rc 0;uv run --directory rest/python/server pytest279 passed, 12 subtests passed, rc 0;ruff checkandruff format --checkat the pre-commit pin 0.14.13 both rc 0.