Use the correct verifier for RSA PSS scheme keys #625
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
|
I've tested it, and it solves the issue 馃槂 |
| if !ok { | ||
| return &ErrType{Msg: "failed to convert public key to RSA PSS key"} | ||
| } | ||
| verifier, err = signature.LoadRSAPSSVerifier(publicKeyRSAPSS, hash, &rsa.PSSOptions{Hash: crypto.SHA256}) |
There was a problem hiding this comment.
FYI, if you're using the Verifier interface, you can also load a verifier with a PSS option now - https://github.com/sigstore/sigstore/blob/main/pkg/signature/signerverifier_test.go#L30-L38
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following PR fixes an issue with go-tuf's support for RSA key types.
Details:
Apparently for RSA key types
signature.LoadVerifier()is defaulting to returning a verifier that isRSAPKCS1v15Verifierwhich corresponds to the RSA PKCS#1 scheme.Based on the latest TUF spec, TUF uses RSA PSS instead of PKCS#1. This manifests itself by causing go-tuf v2 TUF clients to fail metadata verification in case of RSA key types.
The fix for this is to invoke the proper verifier for the PSS scheme. This means that when we are verifying a metadata signed by an RSA key type, we should use
LoadRSAPSSVerifier()instead of the genericLoadVerifier().References:
Credits:
Thanks to @kairoaraujo for reaching out and helping track this together! 馃殌 Cheers! 馃嵒
What's left: