Skip to content

Comments

Fix RSA-PSS signature verification and key generation issues#156

Merged
rlm2002 merged 4 commits intowolfSSL:masterfrom
cconlon:rsaSigFixes
Sep 15, 2025
Merged

Fix RSA-PSS signature verification and key generation issues#156
rlm2002 merged 4 commits intowolfSSL:masterfrom
cconlon:rsaSigFixes

Conversation

@cconlon
Copy link
Member

@cconlon cconlon commented Sep 10, 2025

This PR includes several fixes for RSA-PSS signature verification and key generation issues:

  • Fix WolfCryptSignature.engineVerify() to correctly pass digest to rsaPssVerifyWithDigest() instead of incorrect digest as "full data"
  • Add restriction for RSAPrivateCrtKey keys in WolfCryptSignature, similar to WolfCryptCipher, since native wolfCrypt requires CRT parameters for RSA ops.
  • Improve RSASSA-PSS KeyPairGenerator compatibility with system KeyFactory
  • Fix default SHA-256 salt length in WolfCryptPSSParameters

This PR includes JUnit tests to help prevent regression.

These fixes fix several of the OpenJDK SunJCE tests that were failing with wolfJCE running underneath.

@cconlon cconlon self-assigned this Sep 10, 2025
@cconlon cconlon requested a review from Copilot September 10, 2025 23:38
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes several RSA-PSS signature verification and key generation issues in the wolfJCE provider to improve compatibility with OpenJDK SunJCE tests.

  • Fixes WolfCryptSignature.engineVerify() to use correct digest parameter in rsaPssVerifyWithDigest() method
  • Adds restriction for RSA private keys to require CRT parameters, similar to cipher implementation
  • Implements dedicated RSASSA-PSS key pair generator with proper algorithm identification and system KeyFactory compatibility
  • Corrects default SHA-256 salt length in PSS parameters

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
WolfCryptSignature.java Fixes RSA-PSS signature verification logic and adds RSA private key validation
WolfCryptPssParameters.java Updates default salt length to use SHA-256 digest size
WolfCryptProvider.java Registers dedicated RSASSA-PSS key pair generator service
WolfCryptKeyPairGenerator.java Implements RSASSA-PSS key generation with proper algorithm identification
WolfCryptSignatureTest.java Adds comprehensive test for RSA-PSS multiple updates scenario
WolfCryptKeyPairGeneratorTest.java Adds test for RSASSA-PSS key compatibility with system KeyFactory

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

… similar to WolfCryptCipher. Give better exception to user in those cases.
…ineVerify() to pass digest instead of full data
@rlm2002 rlm2002 merged commit 1f06665 into wolfSSL:master Sep 15, 2025
46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants