Ed25519 PKCS#8 v2 private keys with correctly-formed (implicitly tagged) public keys are rejected

[briansmith]

See the second example in https://tools.ietf.org/html/rfc8410#section-10.3:

-----BEGIN PRIVATE KEY-----
   MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
   oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
   Z9w7lshQhqowtrbLDFw4rXAxZuE=
-----END PRIVATE KEY-----

Reported by @est31 in openssl/openssl#9134 (comment).

[briansmith]

Working on the solution for #1424, I read the code and it seems like we do indeed skip over attributes. See

ring/src/pkcs8.rs

Lines 138 to 142 in 24c9d3b

	// Ignore any attributes that are present.
	if input.peek(der::Tag::ContextSpecificConstructed0 as u8) {
	let _ = der::expect_tag_and_get_value(input, der::Tag::ContextSpecificConstructed0)
	.map_err(|error::Unspecified| error::KeyRejected::invalid_encoding())?;
	}

If we encounter [0] then we skip it and carry on.

The reason the RFC example isn't accepted is due to our misunderstanding about the encoding of the public key [1]; it is IMPLICITLY tagged, not EXPLICITLY tagged. See #1464; Thanks to @ShadowJonathan for figuring this out.

[briansmith]

PR #1466 is the first step towards fixing this by improving the testing scaffolding.

[briansmith]

Fixed in #1680