public_key: Handle key params only present in SignatureAlgorithm of a cert

[IngelaAndin]

closes #9632

[github-actions]

CT Test Results

  2 files   17 suites   4m 38s ⏱️
286 tests 282 ✅ 4 💤 0 ❌
302 runs  298 ✅ 4 💤 0 ❌

Results for commit 3c1957e.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• Windows Installer

// Erlang/OTP Github Action Bot

[Copilot]

Pull Request Overview

This PR adds handling for RSA-PSS key parameters when they are only present in the certificate’s signature algorithm (not in the SubjectPublicKeyInfo), and adds corresponding tests.

• Introduces a new key_params/2 helper to extract PSS parameters from the signature algorithm if missing from the key info.
• Updates validate_signature/6 to use key_params/2 before verifying.
• Adds pkix_pss_params_in_signalg tests in public_key_SUITE.erl and cleans up an EDDSA test case.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/public_key/src/pubkey_cert.erl	Added key_params/2, updated validate_signature/6 callsite.
lib/public_key/test/public_key_SUITE.erl	Added PSS‐params tests and minor EDDSA test cleanup.

Comments suppressed due to low confidence (3)

lib/public_key/src/pubkey_cert.erl:2200

• [nitpick] Consider adding a docstring above key_params/2 to explain when and why it extracts parameters from the certificate's signature algorithm, improving maintainability and clarity.

key_params(#'OTPCertificate'{tbsCertificate = TBSCert}, Params) when Params == asn1_NOVALUE;

lib/public_key/test/public_key_SUITE.erl:1466

• Add a test case covering the scenario where key parameters are explicitly 'NULL' in the SubjectPublicKeyInfo to ensure key_params/2 correctly handles both asn1_NOVALUE and 'NULL' inputs.

pkix_pss_params_in_signalg() ->

lib/public_key/src/pubkey_cert.erl:261

• [nitpick] The parameter name KeyParams0 is not descriptive; consider renaming it to something like RawKeyParams or InitialParams to clarify its purpose before transformation.

validate_signature(Cert, DerCert, Key, KeyParams0,

[u3s]

is this anyhow covered in RFCs?

[u3s]

maybe this case is not needed?

• if you match on ?'id-RSASSA-PSS' in function head
• 2nd case clause would be handled by existing 2nd function clause

[IngelaAndin]

I did not due avoiding long lines, but I split it differently so as to be able to match in function head which I normally prefer.

[IngelaAndin]

is this anyhow covered in RFCs?

Not explicitly. I think the ASN.1 specs makes it quite possible and it makes sense for RSA keys as you can then upgrade an existing intermediat RSA cert to an RSA-PSS-PSS cert without changing the intermediate cert. And OpenSSL will verify this chain.