crypto: add lenient versions for JWT parsing

atproto/crypto/k256.go

···
 	RejectMalleable: true,
 }
 
+var k256LenientOptions = &secp256k1secec.ECDSAOptions{
+	// Used to *verify* digest, not to re-hash
+	Hash: crypto.SHA256,
+	// Use `[R | S]` encoding.
+	Encoding: secp256k1secec.EncodingCompact,
+	// Allows (eg, for JWT validation)
+	RejectMalleable: false,
+}
+
 // Creates a secure new cryptographic key from scratch, with the indicated curve type.
 func GeneratePrivateKeyK256() (*PrivateKeyK256, error) {
 	key, err := secp256k1secec.GenerateKey()
···
 func (k *PublicKeyK256) HashAndVerify(content, sig []byte) error {
 	hash := sha256.Sum256(content)
 	if !k.pubK256.Verify(hash[:], sig, k256Options) {
+		return ErrInvalidSignature
+	}
+	return nil
+}
+
+// Same as HashAndVerify(), only does not require "low-S" signature.
+//
+// Used for, eg, JWT validation.
+func (k *PublicKeyK256) HashAndVerifyLenient(content, sig []byte) error {
+	hash := sha256.Sum256(content)
+	if !k.pubK256.Verify(hash[:], sig, k256LenientOptions) {
 		return ErrInvalidSignature
 	}
 	return nil

atproto/crypto/keys.go

···
 	// Hashes the raw bytes using SHA-256, then verifies the signature of the digest bytes.
 	HashAndVerify(content, sig []byte) error
 
+	// Same as HashAndVerify(), only does not require "low-S" signature. Used for, eg, JWT validation.
+	HashAndVerifyLenient(content, sig []byte) error
+
 	// String serialization of the key bytes using common parameters:
 	// compressed byte serialization; multicode varint code prefix; base58btc
 	// string encoding ("z" prefix)

atproto/crypto/p256.go

···
 	return nil
 }
 
+// Same as HashAndVerify(), only does not require "low-S" signature.
+//
+// Used for, eg, JWT validation.
+func (k *PublicKeyP256) HashAndVerifyLenient(content, sig []byte) error {
+	hash := sha256.Sum256(content)
+	// parseP256Sig
+	if len(sig) != 64 {
+		return fmt.Errorf("crypto: P-256 signatures must be 64 bytes, got len=%d", len(sig))
+	}
+	r := big.NewInt(0)
+	s := big.NewInt(0)
+	r.SetBytes(sig[:32])
+	s.SetBytes(sig[32:])
+
+	if !ecdsa.Verify(&k.pubP256, hash[:], r, s) {
+		return ErrInvalidSignature
+	}
+
+	return nil
+}
+
 // Multibase string encoding of the public key, including a multicodec indicator and compressed curve bytes serialization
 func (k *PublicKeyP256) Multibase() string {
 	kbytes := k.Bytes()