Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/rsa: pss may have wrong salt length #42741

Closed
zhangzhanli opened this issue Nov 20, 2020 · 4 comments
Closed

crypto/rsa: pss may have wrong salt length #42741

zhangzhanli opened this issue Nov 20, 2020 · 4 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Milestone

Comments

@zhangzhanli
Copy link

zhangzhanli commented Nov 20, 2020

crypto/rsa/pss.go : 272 in latest version of go

When PSSOptions's saltLength is PSSSaltLengthAuto, we just try to maximize the length of salt. But there are some problems with it where the bit length of N of private key is congruent to 1 module 8. (i.e. bitlen(N) == 8k + 1) . Under these situations, when checking emLen in crypto/rsa/pss.go : 50 which is equal to hLen+sLen+1, we will alway get an error "key size too small for PSS signature". And I didn't see there are such problems with openssl. So, maybe we need a change?

@zhangzhanli zhangzhanli changed the title rsa pss may has wrong salt length rsa pss may have wrong salt length Nov 20, 2020
@martisch martisch changed the title rsa pss may have wrong salt length crypto/rsa: pss may have wrong salt length Nov 20, 2020
@martisch
Copy link
Contributor

Cc @FiloSottile

@martisch martisch added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Nov 20, 2020
@FiloSottile
Copy link
Contributor

Yep, this is broken and has been broken at least since Go 1.13, so not a Go 1.16 fix. Scheduling for 1.17, thank you!

https://play.golang.org/p/hgTw2zJW2OI

@FiloSottile FiloSottile added this to the Go1.17 milestone Dec 2, 2020
@odeke-em
Copy link
Member

odeke-em commented Mar 7, 2021

@zhangzhanli thank you for the catching this, and thanks @martisch and @FiloSottile for the triaging and responses.

@zhangzhanli, the Go1.17 tree is now open, and if you are interested in becoming a Go contributor, please go ahead and send a CL or PR, as you please— it would be awesome to have you as a contributor to the Go project!

@odeke-em odeke-em added NeedsFix The path to resolution is known, but the work has not been done. and removed NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Mar 7, 2021
@gopherbot
Copy link

Change https://golang.org/cl/302230 mentions this issue: crypto/rsa: fixes the salt length calculation when PSSSaltLengthAuto option is set in rsa sign request.

@golang golang locked and limited conversation to collaborators Mar 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
None yet
Development

No branches or pull requests

5 participants