Treat RSASSA-PSS keys like rsaEncryption RSA keys
In theory we should treat any parameters and the identifier itself as restriction to only use the key to create signatures accordingly (e.g. only use RSA with PSS padding or even use specific hash algorithms). But that's currently tricky as we'd have to store and pass this information along with our private keys (i.e. use PKCS#8 to store them and change the builder calls to pass along the identifier and parameters). That would require quite some work.
This commit is contained in:
@@ -57,8 +57,13 @@ static public_key_t *parse_public_key(chunk_t blob)
|
||||
int oid = asn1_parse_algorithmIdentifier(object,
|
||||
parser->get_level(parser)+1, NULL);
|
||||
|
||||
if (oid == OID_RSA_ENCRYPTION || oid == OID_RSAES_OAEP)
|
||||
if (oid == OID_RSA_ENCRYPTION || oid == OID_RSAES_OAEP ||
|
||||
oid == OID_RSASSA_PSS)
|
||||
{
|
||||
/* TODO: we should parse parameters for PSS and pass them
|
||||
* (and the type), or the complete subjectPublicKeyInfo,
|
||||
* along so we can treat these as restrictions when
|
||||
* generating signatures with the associated private key */
|
||||
type = KEY_RSA;
|
||||
}
|
||||
else if (oid == OID_EC_PUBLICKEY)
|
||||
|
||||
Reference in New Issue
Block a user