pkcs7: add RSA-PSS support for SignedData#9742
Open
sameehj wants to merge 1 commit intowolfSSL:masterfrom
Open
pkcs7: add RSA-PSS support for SignedData#9742sameehj wants to merge 1 commit intowolfSSL:masterfrom
sameehj wants to merge 1 commit intowolfSSL:masterfrom
Conversation
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
6 times, most recently
from
c4749c5 to
38bcb07
Compare
Contributor
Author
|
retest this please |
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
3 times, most recently
from
75dec4a to
ba4a84f
Compare
Add full RSA-PSS (RSASSA-PSS) support to PKCS#7 SignedData encoding and verification. This change enables SignerInfo.signatureAlgorithm to use id-RSASSA-PSS with explicit RSASSA-PSS-params (hash, MGF1, salt length), as required by RFC 4055 and CMS profiles. Key changes: - Add RSA-PSS encode and verify paths for PKCS7 SignedData - Encode full RSASSA-PSS AlgorithmIdentifier parameters - Decode RSA-PSS parameters from SignerInfo for verification - Treat RSA-PSS like ECDSA (sign raw digest, not DigestInfo) - Fix certificate signatureAlgorithm parameter length handling - Add API test coverage for RSA-PSS SignedData This resolves failures when using RSA-PSS signer certificates (e.g. -173 invalid signature algorithm) and maintains backward compatibility with RSA PKCS#1 v1.5 and ECDSA. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
sameehj
force-pushed
the
pkcs7-rsa-pss
branch
from
ba4a84f to
fba2b1a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add full RSA-PSS (RSASSA-PSS) support to PKCS#7 SignedData encoding and verification.
This change enables
SignerInfo.signatureAlgorithmto use id-RSASSA-PSS with explicit RSASSA-PSS-params (hash, MGF1, salt length), as required by RFC 4055 and CMS profiles.Key changes:
This resolves failures when using RSA-PSS signer certificates (e.g. -173 invalid signature algorithm) and maintains backward compatibility with RSA PKCS#1 v1.5 and ECDSA.
Testing
test_wc_PKCS7_EncodeSignedData_RSA_PSS(guarded byHAVE_PKCS7,WC_RSA_PSS, RSA, filesystem, SHA-256). Usescerts/rsapss/client-rsapss.derandclient-rsapss-priv.der; encodes SignedData and optionally round-trip verifies.os-check.ymlupdated with build--enable-pkcs7 CPPFLAGS=-DWC_RSA_PSS.Checklist