crypto/x509: RSAES-OAEP support #30416
Comments
|
/cc @FiloSottile |
bcmills
added
NeedsInvestigation
|
CC @agl |
FiloSottile
changed the title
|
I'm assuming this is about RSAES-OAEP public keys, specified in RFC 4055 and 5756. I imagine these keys are encryption only, so not very useful for TLS. Note that we don't even support certificate keys with |
|
Yes both your assumptions are correct. TPM manufacturers have since switched to using rsaEncryption keys, however a significant portion of machines still have TPMs whose public keys are RSAES-OAEP. From what I can gather the difficulty with adding proper support for RSAES-OAEP public keys is that their parameters have non-integer default values (which is not currently supported). For our purposes we do not need to parse the parameters so leaving them as a RawValue is fine. |
|
The main problem with For parsing we can use golang.org/x/crypto/cryptobyte if encoding/asn1 does not fit. |
) This currently populates an *rsa.PublicKey value, but it does not return or expose the associated hashing and masking algorithms, so the key can't be used to validate signatures. Upstream `crypto/x509` issue for support is: golang/go#30416
crypto/x509 now enforces that rsa public keys must have NULL parameters. The old no longer solves the issue and instead will silently fail when parsing the key, ultimately causing a null pointer dereference at (pubkey := cert.PublicKey.(*rsa.PublicKey)). Currently working with crypto/x509 to add support for RSAES-OAEP keys golang/go#30416
crypto/x509 now enforces that rsa public keys must have NULL parameters. The old no longer solves the issue and instead will silently fail when parsing the key, ultimately causing a null pointer dereference at (pubkey := cert.PublicKey.(*rsa.PublicKey)). Currently working with crypto/x509 to add support for RSAES-OAEP keys golang/go#30416
crypto/x509 now enforces that rsa public keys must have NULL parameters. The old fix no longer solves the issue and instead will silently fail when parsing the key, ultimately causing a null pointer dereference at (pubkey := cert.PublicKey.(*rsa.PublicKey)). Currently working with crypto/x509 to add support for RSAES-OAEP keys golang/go#30416 For certificate-transparency-go have accepted a temporary fix to /x509 google/certificate-transparency-go#470 so we will be building against them for the time being.
crypto/x509 now enforces that rsa public keys must have NULL parameters. The old fix no longer solves the issue and instead will silently fail when parsing the key, ultimately causing a null pointer dereference at (pubkey := cert.PublicKey.(*rsa.PublicKey)). Currently working with crypto/x509 to add support for RSAES-OAEP keys golang/go#30416 certificate-transparency-go have accepted a temporary fix to /x509 google/certificate-transparency-go#470 so we will be building against them for the time being.
x509 currently does not support parsing rsaesoap pub keys.
Use case is calling x509 to extract the public EK from TPMs for verification purposes.
There are many old TPM units that use this key type.
The text was updated successfully, but these errors were encountered: