In PKCS#11, can I set a custom base point for a secp256r1 ECDSA signature?

Question

According to FIPS 186-4 § D.1.1.5 Choice of Base Points I should be able to create ECDSA signatures with custom base points on P-256 (secp256r1).

Does standard PKCS#11 support this feature?

This is how far I got building example code, based on org.xipki:ipkcs11wrapper:1.0.4 and SoftHSM 2.6.1:

import org.xipki.pkcs11.wrapper.*
import org.xipki.pkcs11.wrapper.PKCS11Constants.*
import org.xipki.pkcs11.wrapper.attrs.Attribute
import java.math.BigInteger
import java.util.*

const val PATH = "/opt/homebrew/lib/softhsm/libsofthsm2.so"
val PIN = "1234".toCharArray()
val MESSAGE = "hello world".toByteArray()
val KEY_ID = AttributeVector(
    Attribute.getInstance(CKA_ID, BigInteger.valueOf(1))
)

fun main() {
    val module = PKCS11Module.getInstance(PATH).apply { initialize() }
    val slot = module.getSlotList(true).first()
    val token = PKCS11Token(slot.token, true, PIN).apply {
        require(supportsMechanism(CKM_ECDSA, CKF_EC_F_P))
        require(!supportsMechanism(CKM_ECDSA, CKF_EC_ECPARAMETERS))
    }
    val key = token.getKey(KEY_ID)
    val params = null // I would expect to be able to set a base point here
    val mechanism = Mechanism(CKM_ECDSA, params)
    val value = token.sign(mechanism, key.id().handle, MESSAGE)
    println(Base64.getEncoder().encodeToString(value))
}

The code runs successfully, including the require assertions. But it still uses the standard base point from P-256. I suspect that the Mechanism parameters configurable, but could not find a reasonable value in the library or in the standard.

Answer 1

ECDSA signing with a standard curve but using custom base point is theoretically allowed by some standards, but it is not common practice and I don't know of any API that supports it. It is not supported by PKCS#11, neither version 2.40 nor version 3.0: in both cases, the ECDSA mechanism does not have a parameter.

Looking at the code of SoftHSM, it supports ECDSA either with a Botan backend or with an OpenSSL backend, neither of which implement an extension to select a custom base point. Which makes sense because SoftHSM intends to be a functional replacement for HSM and most HSM don't have this feature.

You may be able to do ECDSA with secp256r1 but a custom base point by configuring a different curve when creating the key object. You can, in principle, create a private or public key object on a custom curve: the CKA_EC_PARAMS parameter can either specify a named curve or all the curve parameters. But very few libraries or HSM support anything but named curves. Custom curves are risky (if you don't know what you're doing, you can easily choose insecure parameters) and difficult to implement (a lot of optimizations require precise knowledge about the parameters), so they never got popular.