feat(wasi_crypto): implement ECDSA public key verification (#4932)

Implement Ecdsa::PublicKey::verify() using EVP_PKEY_public_check. Part of #2669. Signed-off-by: Parth Dagia <parth.24bcs10414@sst.scaler.com>
0yi0 · Jun 26, 2026 · Jun 11, 2026 · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
commit 6b32b0c71c7cdf9207cfea35d6065423f71e732c
diff --git a/plugins/wasi_crypto/asymmetric_common/ecdsa.h b/plugins/wasi_crypto/asymmetric_common/ecdsa.h
@@ -82,7 +82,14 @@ class Ecdsa {
     }
 
     WasiCryptoExpect<void> verify() const noexcept {
-      return WasiCryptoUnexpect(__WASI_CRYPTO_ERRNO_NOT_IMPLEMENTED);
+      EvpPkeyCtxPtr CheckCtx{EVP_PKEY_CTX_new(Ctx.get(), nullptr)};
+      ensureOrReturn(CheckCtx, __WASI_CRYPTO_ERRNO_ALGORITHM_FAILURE);
+      // EVP_PKEY_public_check() returns 1 for a valid key and 0 for an invalid
+      // one. A negative value means the check is unsupported for this key type
+      // (e.g. on OpenSSL 1.1.1), so only an explicit 0 is treated as invalid.
+      ensureOrReturn(EVP_PKEY_public_check(CheckCtx.get()) != 0,
+                     __WASI_CRYPTO_ERRNO_INVALID_KEY);
+      return {};
     }
 
   protected:

diff --git a/test/plugins/wasi_crypto/signatures.cpp b/test/plugins/wasi_crypto/signatures.cpp
@@ -62,6 +62,9 @@ TEST_F(WasiCryptoTest, Signatures) {
     WASI_CRYPTO_EXPECT_TRUE(publickeyVerify(PkHandle));
   };
   PublicKeyVerifyTest(__WASI_ALGORITHM_TYPE_SIGNATURES, "Ed25519"sv);
+  PublicKeyVerifyTest(__WASI_ALGORITHM_TYPE_SIGNATURES, "ECDSA_P256_SHA256"sv);
+  PublicKeyVerifyTest(__WASI_ALGORITHM_TYPE_SIGNATURES, "ECDSA_K256_SHA256"sv);
+  PublicKeyVerifyTest(__WASI_ALGORITHM_TYPE_SIGNATURES, "ECDSA_P384_SHA384"sv);
 
   // A raw public key with an invalid length is rejected on import.
   auto PublicKeyImportInvalidTest = [this](__wasi_algorithm_type_e_t AlgType,
@@ -73,6 +76,21 @@ TEST_F(WasiCryptoTest, Signatures) {
   };
   PublicKeyImportInvalidTest(__WASI_ALGORITHM_TYPE_SIGNATURES, "Ed25519"sv);
 
+  // A SEC1 public key whose point is not on the curve is rejected on import.
+  auto PublicKeyImportInvalidSecTest = [this](__wasi_algorithm_type_e_t AlgType,
+                                              std::string_view Alg) {
+    SCOPED_TRACE(Alg);
+    WASI_CRYPTO_EXPECT_FAILURE(
+        publickeyImport(
+            AlgType, Alg,
+            "04ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"_u8v,
+            __WASI_PUBLICKEY_ENCODING_SEC),
+        __WASI_CRYPTO_ERRNO_INVALID_KEY);
+  };
+  PublicKeyImportInvalidSecTest(__WASI_ALGORITHM_TYPE_SIGNATURES,
+                                "ECDSA_P256_SHA256"sv);
+
   auto SigEncodingTest =
       [this](
           std::string_view Alg,