2019-02-19_fix-pss-saltlen

[ntrepid8]

Changes

• use -1 instead of -2 for sign according to RFC7518
• update docs according to RFC7518 and pkeyutl/evp_pkey_ctrl_str

Notes

I was looking at the RFC here:

• https://tools.ietf.org/html/rfc7518#section-3.5

This line in section 3.5:

The size of the salt value is the same size as
the hash function output.

The issue was discovered trying to pass values between this library and an equivalent Python library. I don't think this should cause any backward compatibility problems because we only change to use -1 for creating the signature but -2 is still used to verify the signature which should work for the max-length and for the hash-length formats.

[ntrepid8]

Is there some trick to get the tests to pass? When I run them locally they pass sometimes and they fail sometimes. I'm not really sure what makes the difference.

[opsb]

We ran into this issue as well. We discovered that while this PR configures the correct salt length, jose doesn't actually use the jose_jws_alg_rsa_pss so the config is never used. To get it working we had to use this config in ets.

:ets.insert(:jose_jwa, {{:rsa_sign, :rsa_pkcs1_pss_padding}, {
      :public_key,
      [
        {:rsa_padding, :rsa_pkcs1_pss_padding},
        {:rsa_pss_saltlen, -1}
      ]
}})

By default https://github.com/potatosalad/erlang-jose/blob/master/src/jose_jwa.erl#L114 is returning {public_key, opts} so the jose_jws_alg_rsa_pss module isn't actually being used for the signing. For this reason the current PR seems like only half the story.

If erlang's public_key module is being used currently the question is, does it support the salt length configuration (it doesn't from what we can tell). If not then should the pure erlang implementation be used by default?

[opsb]

@ntrepid8 were you able to use jose with your configuration change somehow?

[ntrepid8]

@opsb as I recall we were able to make jose interact correctly with our other services once this change was made. Specifically we were able to use it with the Python library:

• https://github.com/latchset/jwcrypto

[potatosalad]

@ntrepid8 You are exactly right, I misread RFC7518 — Section 3.5. Digital Signature with RSASSA-PSS where is says:

The size of the salt value is the same size as the hash function output.

Thank you for the fix, this has been merged into develop and will be released as part of version 1.10.0 soon-ish.