add salt length calculation with PSSSaltLengthAuto - #96
Closed
maraino wants to merge 1 commit into
Closed
Conversation
When PSSSaltLengthAuto is set, the maximum salt length must equal: (modulus_key_size - 1 + 7)/8 - hash_length - 2 For example, for a 4096-bit modules key and SHA256 it should be: (4096 - 1 + 7)/8 - 32 - 2 = 478 See https://golang.org/cl/302230
maraino
changed the title
Contributor
Author
|
@solcates, are you maintaining this repo? Any updates on this? |
optnfast
approved these changes
Aug 15, 2022
optnfast
left a comment
optnfast
left a comment
Contributor
There was a problem hiding this comment.
The change looks good to me.
Contributor
Author
Contributor
|
@solcates would be my first thought but I no longer work for Thales so I don't really know. |
solcates
approved these changes
Feb 18, 2024
solcates
left a comment
solcates
left a comment
Contributor
There was a problem hiding this comment.
Sorry, I haven't been checking up on this code like I should have
LGTM
Contributor
Author
@solcates is it possible to merge this and tag a new version? |
Contributor
|
Hi @maraino 😃 , TY 🙏 for your interest and this PR. I am part of the new maintainers of In 2026 the big project for
The other big project for 2026 is giving + moving the crypto11 project under the Eclipse Foundation. This is an opportunity for us to reconsider PRs and issues. And I can see your PR was on track for a merge... until it wasn't anymore. I apologize for this, lets see if we can do better 😺 . I see 2 options:
In case I can not use your PR as is, I will mention your contribution in the commits and changelogs. Thank you for this valuable input. |
Nicolas-Peiffer
added a commit
that referenced
this pull request
Aug 3, 2026
signPSS returned errUnsupportedRSAOptions for rsa.PSSSaltLengthAuto, behind a TODO saying the biggest possible salt could in principle be worked out from the key. It can, and crypto/rsa already does it: (modulus_bits - 1 + 7)/8 - hash_length - 2 For a 4096-bit modulus and SHA-256 that is (4096-1+7)/8 - 32 - 2 = 478. The salt is the largest the encoded message can carry, so callers that pass the zero-valued PSSOptions.SaltLength — the crypto.Signer default, and what several callers hand us without thinking about salts at all — now get a signature rather than an error. Verifiers accept it either way: PSSSaltLengthAuto recovers the salt length from the encoding. The calculation moves into maxPSSSaltLength so it can be tested without a token, and differs from #96 in one respect. That PR computes the length as uint(k.N.BitLen()-1+7)/8 - 2 - hLen, all unsigned; a modulus too small for the chosen hash (SHA-512 at 521 bits or below) makes that subtraction wrap and yields a salt length near 2^64 instead of an error. Doing the arithmetic in int and reporting rsa.ErrMessageTooLong on a negative result matches what crypto/rsa returns for the same case. errUnsupportedRSAOptions is still returned for PSSSaltLengthAuto when the key's public half is not an *rsa.PublicKey, since there is no modulus to size the salt from. Both doc comments that described Auto as unsupported are updated. testRsaSigningPSS now runs each hash against both Auto and EqualsHash, and TestMaxPSSSaltLength covers the helper against the crypto/rsa expression for 1024- through 4096-bit keys across SHA-1..SHA-512, round-trips a signature through VerifyPSS with Auto, and pins the two error paths. It skips the 4096-bit key under -short, where generating it dominates the runtime. Note that a token is free to reject a salt length it does not implement; SoftHSMv3 does not advertise CKM_RSA_PKCS_PSS at all, so TestHardRSA's PSS subtests skip there and this path is covered natively. Fixes the TODO with the calculation from #96 by @maraino, who also supplied the worked 4096/SHA-256 example above and the crypto/rsa change it follows (https://golang.org/cl/302230). Refs #96 — #96 Co-Authored-By: Mariano Cano <mariano.cano@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds support for signing using rsa.PSSSaltLengthAuto
When PSSSaltLengthAuto is set, the maximum salt length must equal:
(modulus_key_size - 1 + 7)/8 - hash_length - 2
For example, for a 4096-bit modules key and SHA256 it should be:
(4096 - 1 + 7)/8 - 32 - 2 = 478
See https://golang.org/cl/302230