Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor GenerateSignature to eliminate manual RSA private encryption implementation #257

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

xc2
Copy link

@xc2 xc2 commented Dec 19, 2024

Why

There is a manual implementation of RSA private encryption in the codebase, which is generally not recommended.

RSA Private Encryption

Mixlib::Authentication uses Ruby's OpenSSL::PKey::RSA.private_encrypt method to “encrypt” version 1.0 headers.

It is essentially an RSA signing operation with PKCS1v15 padding and no digest, so we can simply use rsa.SignPKCS1v15 to “encrypt” (actually sign) the version 1.0 headers.

Equivalent Table

1.0

Ruby

key.private_encrypt("foo")

OpenSSL CLI

echo -n 'foo' | openssl pkeyutl -sign -inkey key.pem

Go

rsa.SignPKCS1v15(rand.Reader, priv, 0, []byte("foo"))

1.3

Ruby

key.sign(OpenSSL::Digest::SHA256, "foo")

OpenSSL CLI

echo -n 'foo' | openssl pkeyutl -rawin -sign -inkey key.pem -digest sha256

Go

rsa.SignPKCS1v15(rand.Reader, priv, crypto.SHA256, sha256.Sum256([]byte("foo")))

This PR

  • Replace the manual implemention of RSA private encryption with rsa.SignPKCS1v15
  • Add tests for signature result (signature10 and signature13 are generated with ruby's RSA module.)
  • Add tests for PKCS#8 key which closes Add an integration test for pkcs8 #219

@xc2 xc2 changed the title Refactor GenerateSignature to eliminate manual signing implementation Refactor GenerateSignature to eliminate manual RSA private encryption implementation Dec 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add an integration test for pkcs8
1 participant