Skip to content

Conversation

xc2
Copy link

@xc2 xc2 commented Dec 19, 2024

Why

There is a manual implementation of RSA private encryption in the codebase, which is generally not recommended.

RSA Private Encryption

Mixlib::Authentication uses Ruby's OpenSSL::PKey::RSA.private_encrypt method to “encrypt” version 1.0 headers.

It is essentially an RSA signing operation with PKCS1v15 padding and no digest, so we can simply use rsa.SignPKCS1v15 to “encrypt” (actually sign) the version 1.0 headers.

Equivalent Table

1.0

Ruby

key.private_encrypt("foo")

OpenSSL CLI

echo -n 'foo' | openssl pkeyutl -sign -inkey key.pem

Go

rsa.SignPKCS1v15(rand.Reader, priv, 0, []byte("foo"))

1.3

Ruby

key.sign(OpenSSL::Digest::SHA256, "foo")

OpenSSL CLI

echo -n 'foo' | openssl pkeyutl -rawin -sign -inkey key.pem -digest sha256

Go

rsa.SignPKCS1v15(rand.Reader, priv, crypto.SHA256, sha256.Sum256([]byte("foo")))

This PR

  • Replace the manual implemention of RSA private encryption with rsa.SignPKCS1v15
  • Add tests for signature result (signature10 and signature13 are generated with ruby's RSA module.)
  • Add tests for PKCS#8 key which closes Add an integration test for pkcs8 #219

@xc2 xc2 changed the title Refactor GenerateSignature to eliminate manual signing implementation Refactor GenerateSignature to eliminate manual RSA private encryption implementation Dec 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add an integration test for pkcs8

1 participant