Adds error vector validation and EC key support

- Implements comprehensive error test vector suite validating
  4,240 negative test cases (bit flip, truncation, API mismatch)
- Adds EC point decompression for compressed P-256 and P-384
  public keys using simplified modular square root
- Updates signature verification to support both P-256
  (SHA-256/secp256r1) and P-384 (SHA-384/secp384r1) curves
- Enables API mismatch test using fail_on_signed streaming option
- All error vectors correctly return {:error, _} as expected
- Maintains 100% success vector compatibility (2,861 tests pass)

Closes #77

Author: johnnyt

CHANGELOG.md

@@ -8,6 +8,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- Error test vector validation suite with 4,240 negative test cases (#77)
+- Compressed EC public key decompression for P-256 and P-384 curves (#77)
+- Multi-curve ECDSA signature verification supporting SHA-256/secp256r1 and SHA-384/secp384r1 (#77)
+- API mismatch test validating unsigned-only streaming decryption mode (#77)
+- Comprehensive error categorization (bit flip, truncation, API mismatch, other) (#77)
 - Full test vector runner executing 2,861 success test vectors via complete decrypt flow (#76)
 - Comprehensive test coverage for all 11 ESDK algorithm suites including committed suites (0x0478, 0x0578)
 - Test vector filtering helpers (success/error tests, raw key tests, encryption algorithm filters)
@@ -36,6 +41,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Examples README updated with category-based navigation and quick start commands
 
 ### Fixed
+- ECDSA signature verification now handles compressed EC public keys (0x02/0x03 prefix) (#77)
+- Signature verification uses correct hash algorithm and curve based on algorithm suite (#77)
 - Header body serialization to include version/type bytes in AAD computation per spec (#76)
 - Required encryption context filtering in header authentication tag computation (#76)
 - CMM test vector helpers to extract key names from EDK provider_info (#76)

lib/aws_encryption_sdk/crypto/ecdsa.ex

@@ -11,7 +11,7 @@ defmodule AwsEncryptionSdk.Crypto.ECDSA do
   """
 
   @type key_pair :: {private_key :: binary(), public_key :: binary()}
-  @type curve :: :secp384r1
+  @type curve :: :secp384r1 | :secp256r1
 
   @doc """
   Generates an ECDSA key pair for the P-384 curve.
@@ -183,6 +183,129 @@ defmodule AwsEncryptionSdk.Crypto.ECDSA do
   @spec verify(binary(), binary(), binary(), curve()) :: boolean()
   def verify(message, signature, public_key, :secp384r1)
       when is_binary(message) and is_binary(signature) and is_binary(public_key) do
-    :crypto.verify(:ecdsa, :sha384, message, signature, [public_key, :secp384r1])
+    # Normalize public key to uncompressed format if needed
+    normalized_key = normalize_public_key(public_key, :secp384r1)
+    :crypto.verify(:ecdsa, :sha384, message, signature, [normalized_key, :secp384r1])
+  end
+
+  @doc """
+  Normalizes a public key to uncompressed format.
+
+  Handles both compressed (0x02/0x03 prefix, 49 bytes for P-384 or 33 bytes for P-256)
+  and uncompressed (0x04 prefix, 97 bytes for P-384 or 65 bytes for P-256) formats.
+
+  The curve is auto-detected from the key size when possible:
+  - 33 bytes compressed or 65 bytes uncompressed → secp256r1
+  - 49 bytes compressed or 97 bytes uncompressed → secp384r1
+  """
+  @spec normalize_public_key(binary(), curve()) :: binary()
+  def normalize_public_key(<<0x04, _rest::binary>> = uncompressed_key, _curve) do
+    # Already uncompressed
+    uncompressed_key
+  end
+
+  # 33-byte key = P-256 compressed (1 prefix + 32 bytes x)
+  def normalize_public_key(<<prefix, _x_coord::binary-size(32)>> = compressed_key, _curve)
+      when prefix in [0x02, 0x03] do
+    decompress_ec_point(compressed_key, :secp256r1)
+  end
+
+  # 49-byte key = P-384 compressed (1 prefix + 48 bytes x)
+  def normalize_public_key(<<prefix, _x_coord::binary-size(48)>> = compressed_key, _curve)
+      when prefix in [0x02, 0x03] do
+    decompress_ec_point(compressed_key, :secp384r1)
+  end
+
+  def normalize_public_key(key, _curve), do: key
+
+  # Manual EC point decompression for NIST curves
+  # Uses simplified modular square root since p ≡ 3 (mod 4) for both P-256 and P-384
+  # See SEC 1 v2.0 Section 2.3.4: https://www.secg.org/sec1-v2.pdf
+
+  # secp256r1 (P-256): 33-byte compressed key (1 prefix + 32 bytes x)
+  defp decompress_ec_point(<<prefix, x_bytes::binary-size(32)>>, :secp256r1)
+       when prefix in [0x02, 0x03] do
+    # secp256r1 curve parameters
+    # p = 2^256 - 2^224 + 2^192 + 2^96 - 1
+    p = 0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF
+
+    # b coefficient from secp256r1 specification
+    b = 0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B
+
+    decompress_with_params(prefix, x_bytes, p, b, 32)
+  end
+
+  # secp384r1 (P-384): 49-byte compressed key (1 prefix + 48 bytes x)
+  defp decompress_ec_point(<<prefix, x_bytes::binary-size(48)>>, :secp384r1)
+       when prefix in [0x02, 0x03] do
+    # secp384r1 curve parameters
+    # p = 2^384 - 2^128 - 2^96 + 2^32 - 1
+    p =
+      0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF
+
+    # b coefficient from secp384r1 specification
+    b =
+      0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF
+
+    decompress_with_params(prefix, x_bytes, p, b, 48)
+  end
+
+  defp decompress_ec_point(key, _curve), do: key
+
+  # Generic decompression using curve parameters
+  defp decompress_with_params(prefix, x_bytes, p, b, coord_size) do
+    # a = -3 (mod p), which is p - 3 for both curves
+    a = p - 3
+
+    # Convert x bytes to integer
+    x = :binary.decode_unsigned(x_bytes, :big)
+
+    # Calculate y² = x³ + ax + b (mod p)
+    # Note: The curve equation is y² = x³ - 3x + b, and a = -3
+    x_cubed = mod_pow(x, 3, p)
+    ax = mod(a * x, p)
+    y_squared = mod(x_cubed + ax + b, p)
+
+    # Since p ≡ 3 (mod 4), we can compute sqrt using: y = y²^((p+1)/4) mod p
+    exponent = div(p + 1, 4)
+    y = mod_pow(y_squared, exponent, p)
+
+    # Determine if we need to negate y based on the prefix
+    # prefix 0x02 = even y, prefix 0x03 = odd y
+    y_is_odd = Integer.mod(y, 2) == 1
+    prefix_wants_odd = prefix == 0x03
+
+    final_y =
+      if y_is_odd == prefix_wants_odd do
+        y
+      else
+        # Use the other root: -y mod p = p - y
+        p - y
+      end
+
+    # Convert y back to binary (big-endian, zero-padded)
+    y_bytes = :binary.encode_unsigned(final_y, :big)
+    y_bytes_padded = pad_to_length(y_bytes, coord_size)
+
+    # Build uncompressed point: 0x04 || x || y
+    <<0x04, x_bytes::binary, y_bytes_padded::binary>>
+  end
+
+  # Modular exponentiation using Erlang's built-in
+  defp mod_pow(base, exp, mod) do
+    :crypto.mod_pow(base, exp, mod)
+    |> :binary.decode_unsigned(:big)
+  end
+
+  # Modular reduction for potentially negative numbers
+  defp mod(n, p) when n >= 0, do: Integer.mod(n, p)
+  defp mod(n, p), do: Integer.mod(n + p, p)
+
+  # Pad binary to specified length with leading zeros
+  defp pad_to_length(binary, length) when byte_size(binary) >= length, do: binary
+
+  defp pad_to_length(binary, length) do
+    padding_size = length - byte_size(binary)
+    <<0::size(padding_size * 8), binary::binary>>
   end
 end

lib/aws_encryption_sdk/decrypt.ex

@@ -15,6 +15,7 @@ defmodule AwsEncryptionSdk.Decrypt do
 
   alias AwsEncryptionSdk.Crypto.AesGcm
   alias AwsEncryptionSdk.Crypto.Commitment
+  alias AwsEncryptionSdk.Crypto.ECDSA
   alias AwsEncryptionSdk.Crypto.HeaderAuth
   alias AwsEncryptionSdk.Crypto.HKDF
   alias AwsEncryptionSdk.Format.BodyAad
@@ -64,7 +65,7 @@ defmodule AwsEncryptionSdk.Decrypt do
              materials.required_encryption_context_keys
            ),
          {:ok, plaintext} <- decrypt_body(message.body, message.header, derived_key),
-         :ok <- verify_signature(message, materials) do
+         :ok <- verify_signature(message, materials, ciphertext) do
       {:ok,
        %{
          plaintext: plaintext,
@@ -197,17 +198,63 @@ defmodule AwsEncryptionSdk.Decrypt do
   end
 
   # Verify signature (for signed suites)
-  defp verify_signature(%{footer: nil}, _materials), do: :ok
+  defp verify_signature(%{footer: nil}, _materials, _ciphertext), do: :ok
 
-  defp verify_signature(%{footer: %{signature: _signature}}, %{verification_key: nil}) do
+  defp verify_signature(
+         %{footer: %{signature: _signature}},
+         %{verification_key: nil},
+         _ciphertext
+       ) do
     # Signed suite but no verification key provided
     {:error, :missing_verification_key}
   end
 
-  defp verify_signature(_message, _materials) do
-    # TO DO: Implement ECDSA signature verification
-    # For now, skip signature verification for signed suites
-    # This will be implemented when we add ECDSA support
-    :ok
+  defp verify_signature(
+         %{footer: %{signature: signature}},
+         %{algorithm_suite: suite, verification_key: verification_key},
+         ciphertext
+       )
+       when is_binary(verification_key) do
+    # Calculate header + body bytes from ciphertext
+    # Footer format: signature_length (2 bytes) + signature
+    # Signature is computed over header + body (everything before the footer)
+    footer_len = 2 + byte_size(signature)
+    message_len = byte_size(ciphertext) - footer_len
+    <<message_bytes::binary-size(message_len), _footer::binary>> = ciphertext
+
+    # Get the correct hash and curve from the algorithm suite
+    {hash_algo, curve} = signature_params_from_suite(suite)
+
+    # Normalize the public key (decompress if needed)
+    normalized_key = ECDSA.normalize_public_key(verification_key, curve)
+
+    # Compute hash and verify signature
+    try do
+      digest = :crypto.hash(hash_algo, message_bytes)
+
+      if :crypto.verify(:ecdsa, hash_algo, {:digest, digest}, signature, [normalized_key, curve]) do
+        :ok
+      else
+        {:error, :signature_verification_failed}
+      end
+    rescue
+      _e ->
+        # :crypto.verify raised an error
+        {:error, :signature_verification_failed}
+    end
+  end
+
+  # Get signature hash algorithm and curve from algorithm suite
+  defp signature_params_from_suite(%{signature_algorithm: :ecdsa_p256}) do
+    {:sha256, :secp256r1}
+  end
+
+  defp signature_params_from_suite(%{signature_algorithm: :ecdsa_p384}) do
+    {:sha384, :secp384r1}
+  end
+
+  defp signature_params_from_suite(_suite) do
+    # Default for backwards compatibility (shouldn't be reached for signed suites)
+    {:sha384, :secp384r1}
   end
 end