-
Notifications
You must be signed in to change notification settings - Fork 23
Open
Description
As shown in the snipped below, this library isn't currently honouring the hashing algorithm or setting a salt length when generating RSA-PSS keys, as it wasn't supported in older versions of Node.js:
webcrypto/src/mechs/rsa/crypto.ts
Lines 37 to 48 in 37dff39
| const keys = crypto.generateKeyPairSync("rsa", { | |
| modulusLength: algorithm.modulusLength, | |
| publicExponent, | |
| publicKeyEncoding: { | |
| format: "der", | |
| type: "spki", | |
| }, | |
| privateKeyEncoding: { | |
| format: "der", | |
| type: "pkcs8", | |
| }, | |
| }); |
I think this crypto.generateKeyPairSync() call should be changed to set the type to rsa-pss (only if using RSA-PSS) and add the following options if the current Node.js version is >= 16.10.0:
hashAlgorithmandmgf1HashAlgorithm: This value is already available in the context (algorithm.hash.name).saltLength: Should match the length of the digest fromhashAlgorithm(e.g.,32for SHA-256), following industry best practices (see, for example, TLS 1.3 and GCP KMS key algorithms).
I suspect this might be a breaking change in those apps/libs using the default values of MGF1 with SHA-1 and saltLength=20 (I think PKI.js' SignedData and Certificate might be affected from a cursory look at CryptoEngine but haven't had the time to double check).
Metadata
Metadata
Assignees
Labels
No labels