From 4258784fe2d2f435b72de0c2486460b61bf37a7e Mon Sep 17 00:00:00 2001 From: sfarestam Date: Tue, 26 May 2026 16:18:03 +0200 Subject: [PATCH] Add brainpoolP320r1 elliptic curve Add brainpoolP320r1 (320-bit, OID 1.3.36.3.3.2.8.1.1.9) from RFC 5639. This curve is fully supported by OpenSSL (NID 929) and used by the Netherlands for DG15 Active Authentication keys in ePassport documents per ICAO 9303. brainpoolP224r1 is deferred as it requires a NID addition to the openssl Rust crate first. --- src/cryptography/hazmat/primitives/asymmetric/ec.py | 9 +++++++++ src/rust/cryptography-key-parsing/src/ec.rs | 4 ++++ src/rust/cryptography-x509/src/oid.rs | 1 + src/rust/src/backend/ec.rs | 2 ++ 4 files changed, 16 insertions(+) diff --git a/src/cryptography/hazmat/primitives/asymmetric/ec.py b/src/cryptography/hazmat/primitives/asymmetric/ec.py index 39e67519cf92..3722025303c1 100644 --- a/src/cryptography/hazmat/primitives/asymmetric/ec.py +++ b/src/cryptography/hazmat/primitives/asymmetric/ec.py @@ -23,6 +23,7 @@ class EllipticCurveOID: SECP384R1 = ObjectIdentifier("1.3.132.0.34") SECP521R1 = ObjectIdentifier("1.3.132.0.35") BRAINPOOLP256R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.7") + BRAINPOOLP320R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.9") BRAINPOOLP384R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.11") BRAINPOOLP512R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.13") @@ -265,6 +266,12 @@ class BrainpoolP256R1(EllipticCurve): ) +class BrainpoolP320R1(EllipticCurve): + name = "brainpoolP320r1" + key_size = 320 + group_order = 0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311 # noqa: E501 + + class BrainpoolP384R1(EllipticCurve): name = "brainpoolP384r1" key_size = 384 @@ -287,6 +294,7 @@ class BrainpoolP512R1(EllipticCurve): "secp521r1": SECP521R1(), "secp256k1": SECP256K1(), "brainpoolP256r1": BrainpoolP256R1(), + "brainpoolP320r1": BrainpoolP320R1(), "brainpoolP384r1": BrainpoolP384R1(), "brainpoolP512r1": BrainpoolP512R1(), } @@ -354,6 +362,7 @@ class ECDH: EllipticCurveOID.SECP384R1: SECP384R1, EllipticCurveOID.SECP521R1: SECP521R1, EllipticCurveOID.BRAINPOOLP256R1: BrainpoolP256R1, + EllipticCurveOID.BRAINPOOLP320R1: BrainpoolP320R1, EllipticCurveOID.BRAINPOOLP384R1: BrainpoolP384R1, EllipticCurveOID.BRAINPOOLP512R1: BrainpoolP512R1, } diff --git a/src/rust/cryptography-key-parsing/src/ec.rs b/src/rust/cryptography-key-parsing/src/ec.rs index 6f1a2760fe7e..fc1de096ae9e 100644 --- a/src/rust/cryptography-key-parsing/src/ec.rs +++ b/src/rust/cryptography-key-parsing/src/ec.rs @@ -32,6 +32,8 @@ pub(crate) fn group_to_curve_oid( #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] openssl::nid::Nid::BRAINPOOL_P256R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP256R1), #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] + openssl::nid::Nid::BRAINPOOL_P320R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP320R1), + #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] openssl::nid::Nid::BRAINPOOL_P384R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP384R1), #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] openssl::nid::Nid::BRAINPOOL_P512R1 => Some(cryptography_x509::oid::EC_BRAINPOOLP512R1), @@ -56,6 +58,8 @@ pub(crate) fn ec_params_to_group( #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] &cryptography_x509::oid::EC_BRAINPOOLP256R1 => openssl::nid::Nid::BRAINPOOL_P256R1, #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] + &cryptography_x509::oid::EC_BRAINPOOLP320R1 => openssl::nid::Nid::BRAINPOOL_P320R1, + #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] &cryptography_x509::oid::EC_BRAINPOOLP384R1 => openssl::nid::Nid::BRAINPOOL_P384R1, #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] &cryptography_x509::oid::EC_BRAINPOOLP512R1 => openssl::nid::Nid::BRAINPOOL_P512R1, diff --git a/src/rust/cryptography-x509/src/oid.rs b/src/rust/cryptography-x509/src/oid.rs index 9f54feab0c62..67a5e6bc4d9b 100644 --- a/src/rust/cryptography-x509/src/oid.rs +++ b/src/rust/cryptography-x509/src/oid.rs @@ -60,6 +60,7 @@ pub const EC_SECP521R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 132, 0, 35); pub const EC_SECP256K1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 132, 0, 10); pub const EC_BRAINPOOLP256R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 7); +pub const EC_BRAINPOOLP320R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 9); pub const EC_BRAINPOOLP384R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 11); pub const EC_BRAINPOOLP512R1: asn1::ObjectIdentifier = asn1::oid!(1, 3, 36, 3, 3, 2, 8, 1, 1, 13); diff --git a/src/rust/src/backend/ec.rs b/src/rust/src/backend/ec.rs index ca215ba1637a..ebfefb080d61 100644 --- a/src/rust/src/backend/ec.rs +++ b/src/rust/src/backend/ec.rs @@ -50,6 +50,8 @@ fn curve_from_py_curve( #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] "brainpoolP256r1" => openssl::nid::Nid::BRAINPOOL_P256R1, #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] + "brainpoolP320r1" => openssl::nid::Nid::BRAINPOOL_P320R1, + #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] "brainpoolP384r1" => openssl::nid::Nid::BRAINPOOL_P384R1, #[cfg(not(any(CRYPTOGRAPHY_IS_BORINGSSL, CRYPTOGRAPHY_IS_AWSLC)))] "brainpoolP512r1" => openssl::nid::Nid::BRAINPOOL_P512R1,