Check for invalid ECDSA key

1 files changed, 8 insertions, 1 deletions

diff --git a/dnsviz/crypto.py b/dnsviz/crypto.py
index ee4978c..9e502f4 100644
--- a/dnsviz/crypto.py
+++ b/dnsviz/crypto.py
@@ -244,7 +244,10 @@ def _dnskey_to_ec(alg, key):
     else:
         raise ValueError('Algorithm not supported')
 
-    return EC.pub_key_from_params(curve, EC_NOCOMPRESSION + key)
+    try:
+        return EC.pub_key_from_params(curve, EC_NOCOMPRESSION + key)
+    except ValueError:
+        return None
 
 def _validate_rrsig_rsa(alg, sig, msg, key):
     pubkey = _dnskey_to_rsa(key)
@@ -314,6 +317,10 @@ def _validate_rrsig_gost(alg, sig, msg, key):
 def _validate_rrsig_ec(alg, sig, msg, key):
     pubkey = _dnskey_to_ec(alg, key)
 
+    # if the key is invalid, then the signature is also invalid
+    if pubkey is None:
+        return False
+
     if alg in (13,):
         alg='sha256'
         sigsize = 64