Skip to content

Comments

Default RSA KeyPairGenerator params, null AlgorithmParameters for non-PSS, RSA exponent sanitization#155

Merged
rlm2002 merged 3 commits intowolfSSL:masterfrom
cconlon:rsaKeyPairGenDefaultParams
Sep 10, 2025
Merged

Default RSA KeyPairGenerator params, null AlgorithmParameters for non-PSS, RSA exponent sanitization#155
rlm2002 merged 3 commits intowolfSSL:masterfrom
cconlon:rsaKeyPairGenDefaultParams

Conversation

@cconlon
Copy link
Member

@cconlon cconlon commented Sep 9, 2025

This PR includes three fixes:

  • In KeyPairGenerator, set default RSA key size and parameters if the application has not explicitly set. We default to RSA 2048 for interop compatibility.
  • In Signature, allow null AlgorithmParameterSpec to be passed in for non-PSS algorithms
  • In KeyPairGenerator, add RSA exponent sanitization. Must be larger than 1 and odd.

JUnit tests are included for regression prevention.

This fixes some of the OpenJDK SunJCE RSA tests.

@cconlon cconlon self-assigned this Sep 9, 2025
@cconlon cconlon requested a review from Copilot September 9, 2025 21:15
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances RSA key generation and signature handling in the WolfSSL JCE provider by implementing proper default parameter handling and input validation. The changes improve compatibility with OpenJDK SunJCE RSA tests.

  • Set default RSA key generation parameters (2048-bit keys) when not explicitly initialized
  • Allow null AlgorithmParameterSpec for non-PSS signature algorithms while rejecting non-null parameters
  • Add RSA public exponent validation to ensure it's positive and odd

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
WolfCryptKeyPairGenerator.java Adds default RSA parameters initialization and public exponent validation
WolfCryptSignature.java Updates parameter handling to accept null for non-PSS algorithms
WolfCryptKeyPairGeneratorTest.java Adds tests for default RSA key generation and invalid exponent validation
WolfCryptSignatureTest.java Adds tests for null parameter handling in non-PSS signatures

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@cconlon cconlon force-pushed the rsaKeyPairGenDefaultParams branch from 05887e6 to 6851635 Compare September 9, 2025 21:32
@cconlon cconlon assigned rlm2002 and unassigned cconlon Sep 9, 2025
@rlm2002 rlm2002 merged commit 34d52b7 into wolfSSL:master Sep 10, 2025
118 of 122 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants