Skip to content

Add salt-length flag #211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maraino merged 1 commit into from
Jan 27, 2025
Merged

Add salt-length flag #211

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions cmd/sign.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ import (
"io"
"math/big"
"os"
"strconv"
"strings"

"github.com/spf13/cobra"
"go.step.sm/crypto/kms"
Expand Down Expand Up @@ -97,6 +99,22 @@ digest of the data file for you.`,
in := flagutil.MustString(flags, "in")
verify := flagutil.MustBool(flags, "verify")

var saltLength int
switch s := strings.ToLower(flagutil.MustString(flags, "salt-length")); s {
case "", "auto":
saltLength = rsa.PSSSaltLengthAuto
case "equal-hash", "hash":
saltLength = rsa.PSSSaltLengthEqualsHash
default:
var err error
if saltLength, err = strconv.Atoi(s); err != nil {
return fmt.Errorf("failed to parse --salt-length=%q: %w", s, err)
}
if saltLength < rsa.PSSSaltLengthEqualsHash {
return fmt.Errorf("flag --salt-length=%q is not valid: salt length cannot be negative", s)
}
}

kuri := ensureSchemePrefix(flagutil.MustString(flags, "kms"))
if kuri == "" {
kuri = name
Expand All @@ -116,7 +134,7 @@ digest of the data file for you.`,
}

pub := signer.Public()
so, err := getSignerOptions(km, pub, alg, pss)
so, err := getSignerOptions(km, pub, alg, pss, saltLength)
if err != nil {
return err
}
Expand Down Expand Up @@ -231,7 +249,7 @@ func jwsSignature(sig []byte, pub crypto.PublicKey) ([]byte, error) {
return append(rBytesPadded, sBytesPadded...), nil
}

func getSignerOptions(km kms.KeyManager, pub crypto.PublicKey, alg string, pss bool) (crypto.SignerOpts, error) {
func getSignerOptions(km kms.KeyManager, pub crypto.PublicKey, alg string, pss bool, saltLength int) (crypto.SignerOpts, error) {
switch k := pub.(type) {
case *ecdsa.PublicKey:
switch k.Curve {
Expand Down Expand Up @@ -259,15 +277,15 @@ func getSignerOptions(km kms.KeyManager, pub crypto.PublicKey, alg string, pss b
if pss {
pssOptions := &rsa.PSSOptions{
Hash: h,
SaltLength: rsa.PSSSaltLengthAuto,
SaltLength: saltLength,
}
// rsa.PSSSaltLengthAuto is not supported by crypto11. The salt
// length here is the same used by Go when PSSSaltLengthAuto is
// used.
//
// This can be fixed if
// https://github.com/ThalesIgnite/crypto11/pull/96 gets merged.
if _, ok := km.(*pkcs11.PKCS11); ok {
if _, ok := km.(*pkcs11.PKCS11); ok && saltLength == rsa.PSSSaltLengthAuto {
pssOptions.SaltLength = (k.N.BitLen()-1+7)/8 - 2 - h.Size()
}
return pssOptions, nil
Expand All @@ -280,7 +298,7 @@ func getSignerOptions(km kms.KeyManager, pub crypto.PublicKey, alg string, pss b
if err != nil {
return nil, err
}
return getSignerOptions(km, pk, alg, pss)
return getSignerOptions(km, pk, alg, pss, saltLength)
default:
return nil, fmt.Errorf("unsupported public key type %T", pub)
}
Expand Down Expand Up @@ -341,6 +359,7 @@ func init() {

flags.Var(alg, "alg", "The hashing `algorithm` to use on RSA PKCS #1 and RSA-PSS signatures.\nOptions are SHA256, SHA384 or SHA512")
flags.Bool("pss", false, "Use RSA-PSS signature scheme instead of RSA PKCS #1")
flags.String("salt-length", "auto", "The salt length used in the RSA-PSS signature scheme.\nOptions are auto (0), equal-hash (-1) or a positive integer")
flags.Var(format, "format", "The `format` to print the signature.\nOptions are base64, hex, jws, or raw")
flags.String("in", "", "The `file` to sign. Required for Ed25519 keys.")
flags.Bool("verify", false, "Verify the signature with the public key")
Expand Down
Loading