Fixed EDDSA context/pre-hash support

Author: antoinelochet

src/bin/util/softhsm2-util-botan.cpp

@@ -837,7 +837,7 @@ eddsa_key_material_t* crypto_malloc_eddsa
 		return NULL;
 	}
 
-	eddsa_key_material_t* keyMat = (eddsa_key_material_t*)malloc(sizeof(eddsa_key_material_t));
+	eddsa_key_material_t* keyMat = (eddsa_key_material_t*)calloc(1, sizeof(eddsa_key_material_t));
 	if (keyMat == NULL)
 	{
 		return NULL;
@@ -848,13 +848,13 @@ eddsa_key_material_t* crypto_malloc_eddsa
 	if (ed25519) oid = Botan::OIDS::lookup("Ed25519");
 	if (oid.empty())
 	{
+		crypto_free_eddsa(keyMat);
 		return NULL;
 	}
 
 	Botan::secure_vector<Botan::byte> derOID;
 	derOID = Botan::DER_Encoder().encode(oid).get_contents();
 
-	memset(keyMat, 0, sizeof(*keyMat));
 	keyMat->sizeOID = derOID.size();
 	keyMat->derOID = (CK_VOID_PTR)malloc(keyMat->sizeOID);
 

src/lib/SoftHSM.cpp

@@ -58,6 +58,10 @@
 #include "ECParameters.h"
 #include "EDPublicKey.h"
 #include "EDPrivateKey.h"
+#ifdef WITH_EDDSA
+#include "EDDSAMechanismParam.h"
+#include "EDDSAUtil.h"
+#endif
 #include "DHParameters.h"
 #include "DHPublicKey.h"
 #include "DHPrivateKey.h"
@@ -4320,6 +4324,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan
 #endif
 #ifdef WITH_EDDSA
 	bool isEDDSA = false;
+	EDDSAMechanismParam eddsaParam;
 #endif
 #ifdef WITH_ML_DSA
 	bool isMLDSA = false;
@@ -4585,6 +4590,10 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan
 			mechanism = AsymMech::EDDSA;
 			bAllowMultiPartOp = false;
 			isEDDSA = true;
+			{
+				CK_RV eddsaRv = EDDSAUtil::getEddsaParam(pMechanism, eddsaParam, &mechanismParam);
+				if (eddsaRv != CKR_OK) return eddsaRv;
+			}
 			break;
 #endif
 #ifdef WITH_ML_DSA
@@ -5410,6 +5419,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
 #endif
 #ifdef WITH_EDDSA
 	bool isEDDSA = false;
+	EDDSAMechanismParam eddsaParam;
 #endif
 #ifdef WITH_ML_DSA
 	bool isMLDSA = false;
@@ -5674,6 +5684,10 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
 			mechanism = AsymMech::EDDSA;
 			bAllowMultiPartOp = false;
 			isEDDSA = true;
+			{
+				CK_RV eddsaRv = EDDSAUtil::getEddsaParam(pMechanism, eddsaParam, &mechanismParam);
+				if (eddsaRv != CKR_OK) return eddsaRv;
+			}
 			break;
 #endif
 #ifdef WITH_ML_DSA

src/lib/crypto/BotanEDDSA.cpp

@@ -38,6 +38,7 @@
 #include "CryptoFactory.h"
 #include "BotanCryptoFactory.h"
 #include "ECParameters.h"
+#include "EDDSAMechanismParam.h"
 #include "BotanEDKeyPair.h"
 #include "BotanUtil.h"
 #include <algorithm>
@@ -62,22 +63,56 @@ BotanEDDSA::~BotanEDDSA()
 	delete verifier;
 }
 
+// Select the Botan EMSA for the requested EdDSA instance
+bool BotanEDDSA::selectEmsa(std::string& emsa, size_t orderLength, const MechanismParam* mechanismParam)
+{
+	emsa = "Pure";
+
+	if (mechanismParam == NULL || !mechanismParam->isOfType(EDDSAMechanismParam::type))
+	{
+		return true;
+	}
+
+	const EDDSAMechanismParam* eddsaParam = (const EDDSAMechanismParam*) mechanismParam;
+
+	if (eddsaParam->contextData.size() > 0)
+	{
+		ERROR_MSG("EDDSA: Context data is not supported in the Botan EDDSA implementation");
+		return false;
+	}
+
+	if (!eddsaParam->flag)
+	{
+		return true;
+	}
+
+	// Ed25519: orderLength = 32, Ed448: orderLength = 57
+	if (orderLength == 32)
+	{
+		emsa = "Ed25519ph";
+		return true;
+	}
+
+	if (orderLength == 57)
+	{
+		ERROR_MSG("EDDSA: Ed448 is not supported in the Botan EDDSA implementation");
+		return false;
+	}
+
+	ERROR_MSG("EDDSA: Unknown EdDSA key size: %lu", (unsigned long) orderLength);
+	return false;
+}
+
 // Signing functions
 bool BotanEDDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign,
 		      ByteString& signature, const AsymMech::Type mechanism,
-		      const MechanismParam* /* mechanismParam */)
+		      const MechanismParam* mechanismParam)
 {
-	std::string emsa;
-
-	if (mechanism == AsymMech::EDDSA)
+	if (mechanism != AsymMech::EDDSA)
 	{
-		emsa = "Pure";
-	}
-        else
-        {
 		ERROR_MSG("Invalid mechanism supplied (%i)", mechanism);
 		return false;
-        }
+	}
 
 	// Check if the private key is the right type
 	if (!privateKey->isOfType(BotanEDPrivateKey::type))
@@ -87,16 +122,22 @@ bool BotanEDDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign,
 		return false;
 	}
 
-        BotanEDPrivateKey* pk = (BotanEDPrivateKey*) privateKey;
-        Botan::Ed25519_PrivateKey* botanKey = dynamic_cast<Botan::Ed25519_PrivateKey*>(pk->getBotanKey());
+	BotanEDPrivateKey* pk = (BotanEDPrivateKey*) privateKey;
+	Botan::Ed25519_PrivateKey* botanKey = dynamic_cast<Botan::Ed25519_PrivateKey*>(pk->getBotanKey());
 
-        if (botanKey == NULL)
-        {
+	if (botanKey == NULL)
+	{
 		ERROR_MSG("Could not get the Botan private key");
 
 		return false;
 	}
 
+	std::string emsa;
+	if (!selectEmsa(emsa, pk->getOrderLength(), mechanismParam))
+	{
+		return false;
+	}
+
 	try
 	{
 		BotanRNG* rng = (BotanRNG*)BotanCryptoFactory::i()->getRNG();
@@ -162,16 +203,10 @@ bool BotanEDDSA::signFinal(ByteString& /*signature*/)
 // Verification functions
 bool BotanEDDSA::verify(PublicKey* publicKey, const ByteString& originalData,
 			const ByteString& signature, const AsymMech::Type mechanism,
-		    const MechanismParam* /* mechanismParam */)
+		    const MechanismParam* mechanismParam)
 {
-	std::string emsa;
-
-	if (mechanism == AsymMech::EDDSA)
+	if (mechanism != AsymMech::EDDSA)
 	{
-		emsa = "Pure";
-	}
-        else
-        {
 		ERROR_MSG("Invalid mechanism supplied (%i)", mechanism);
 
 		return false;
@@ -195,6 +230,12 @@ bool BotanEDDSA::verify(PublicKey* publicKey, const ByteString& originalData,
 		return false;
 	}
 
+	std::string emsa;
+	if (!selectEmsa(emsa, pk->getOrderLength(), mechanismParam))
+	{
+		return false;
+	}
+
 	try
 	{
 		verifier = new Botan::PK_Verifier(*botanKey, emsa);

src/lib/crypto/BotanEDDSA.h

@@ -80,6 +80,9 @@ class BotanEDDSA : public AsymmetricAlgorithm
 	virtual AsymmetricParameters* newParameters();
 
 private:
+	// Derive the Botan EMSA from the key size and the pre-hash flag; context data is not supported
+	static bool selectEmsa(std::string& emsa, size_t orderLength, const MechanismParam* mechanismParam);
+
 	Botan::PK_Signer* signer;
 	Botan::PK_Verifier* verifier;
 };

src/lib/crypto/CMakeLists.txt

@@ -26,6 +26,8 @@ set(SOURCES AESKey.cpp
             ECPublicKey.cpp
             EDPrivateKey.cpp
             EDPublicKey.cpp
+            EDDSAMechanismParam.cpp
+            EDDSAUtil.cpp
             GOSTPrivateKey.cpp
             GOSTPublicKey.cpp
             HashAlgorithm.cpp
@@ -156,7 +158,7 @@ if(CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
 	list(APPEND INCLUDE_DIRS ${PROJECT_SOURCE_DIR}/../win32)
 ENDIF()
 
-if(WITH_BOTAN)
+if(WITH_BOTAN AND CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
 	# mute botan specific warnings
 	# https://github.com/randombit/botan/issues/486
 	list(APPEND COMPILE_OPTIONS "/wd4250;/wd4251;/wd4275;/wd4127;/wd4273") 

src/lib/crypto/EDDSAMechanismParam.cpp

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2026 SoftHSMv2 contributors
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+/*****************************************************************************
+ EDDSAMechanismParam.cpp
+
+ EdDSA mechanism parameters used for signing/verifying operations
+ *****************************************************************************/
+
+#include "config.h"
+#ifdef WITH_EDDSA
+#include "ByteString.h"
+#include "MechanismParam.h"
+#include "EDDSAMechanismParam.h"
+#include <string.h>
+
+EDDSAMechanismParam::EDDSAMechanismParam()
+{
+	flag = false;
+}
+
+// Set the type
+/*static*/ const char* EDDSAMechanismParam::type = "EdDSA Signature param";
+
+EDDSAMechanismParam* EDDSAMechanismParam::clone() const
+{
+	return new EDDSAMechanismParam(*this);
+}
+
+// Check if the parameter is of the given type
+bool EDDSAMechanismParam::isOfType(const char* inType) const
+{
+	return !strcmp(type, inType);
+}
+#endif

src/lib/crypto/EDDSAMechanismParam.h

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2026 SoftHSMv2 contributors
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+/*****************************************************************************
+ EDDSAMechanismParam.h
+
+ EdDSA mechanism parameters used for signing/verifying operations
+ *****************************************************************************/
+
+#ifndef _SOFTHSM_V2_EDDSAMECHANISMPARAM_H
+#define _SOFTHSM_V2_EDDSAMECHANISMPARAM_H
+
+#include "config.h"
+#ifdef WITH_EDDSA
+#include "ByteString.h"
+#include "MechanismParam.h"
+
+class EDDSAMechanismParam : public MechanismParam
+{
+public:
+
+	// EdDSA parameters from ck_eddsa_params
+	bool flag;  // false = no pre-hash (pure), true = with pre-hash (ph)
+	ByteString contextData;
+
+	// The type
+	static const char* type;
+
+	EDDSAMechanismParam();
+
+	virtual EDDSAMechanismParam* clone() const;
+
+	// Check if the mechanism param is of the given type
+	virtual bool isOfType(const char* inType) const;
+};
+
+#endif // WITH_EDDSA
+#endif // !_SOFTHSM_V2_EDDSAMECHANISMPARAM_H

src/lib/crypto/EDDSAUtil.cpp

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 SoftHSMv2 contributors
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+/*****************************************************************************
+ EDDSAUtil.cpp
+
+ EdDSA convenience functions
+ *****************************************************************************/
+
+#include "config.h"
+#ifdef WITH_EDDSA
+#include "EDDSAUtil.h"
+#include "log.h"
+
+// Maximum context data length allowed by CK_EDDSA_PARAMS
+static const CK_ULONG maxEddsaContextDataLen = 255;
+
+/*static*/ CK_RV EDDSAUtil::getEddsaParam(CK_MECHANISM_PTR pMechanism, EDDSAMechanismParam& eddsaParam, MechanismParam** mechanismParam)
+{
+	if (pMechanism->pParameter == NULL_PTR)
+	{
+		if (pMechanism->ulParameterLen != 0)
+		{
+			ERROR_MSG("EDDSA: No parameters supplied but ulParameterLen is %lu", (unsigned long) pMechanism->ulParameterLen);
+			return CKR_ARGUMENTS_BAD;
+		}
+
+		// No parameters means the pure variant without context data
+		return CKR_OK;
+	}
+
+	if (pMechanism->ulParameterLen != sizeof(CK_EDDSA_PARAMS))
+	{
+		ERROR_MSG("EDDSA: ulParameterLen is %lu, expected %lu", (unsigned long) pMechanism->ulParameterLen, (unsigned long) sizeof(CK_EDDSA_PARAMS));
+		return CKR_ARGUMENTS_BAD;
+	}
+
+	CK_EDDSA_PARAMS* ckEddsaParams = (CK_EDDSA_PARAMS*) pMechanism->pParameter;
+
+	if (ckEddsaParams->ulContextDataLen > maxEddsaContextDataLen)
+	{
+		ERROR_MSG("EDDSA: ulContextDataLen is %lu, maximum is %lu", (unsigned long) ckEddsaParams->ulContextDataLen, (unsigned long) maxEddsaContextDataLen);
+		return CKR_ARGUMENTS_BAD;
+	}
+
+	if (ckEddsaParams->ulContextDataLen > 0 && ckEddsaParams->pContextData == NULL_PTR)
+	{
+		ERROR_MSG("EDDSA: ulContextDataLen is %lu but pContextData is NULL", (unsigned long) ckEddsaParams->ulContextDataLen);
+		return CKR_ARGUMENTS_BAD;
+	}
+
+	eddsaParam.flag = (ckEddsaParams->phFlag != CK_FALSE);
+	if (ckEddsaParams->ulContextDataLen > 0)
+	{
+		eddsaParam.contextData = ByteString(ckEddsaParams->pContextData, ckEddsaParams->ulContextDataLen);
+	}
+
+	DEBUG_MSG("EDDSA: preHash=%s, contextDataLen=%lu", eddsaParam.flag ? "true" : "false", (unsigned long) eddsaParam.contextData.size());
+
+	*mechanismParam = &eddsaParam;
+
+	return CKR_OK;
+}
+#endif