grafana/k6

webcrypto: Throw exception on `saltLength: 0` for RSA PSS sign/verify

Open

#4 265 ouverte le 30 oct. 2024

Voir sur GitHub
 (14 commentaires) (0 réactions) (1 assigné)Go (30 564 stars) (1 537 forks)batch import
area: webcryptogood first issuehelp wanted

Description

What?

While implementing support of RSA grafana/xk6-webcrypto#85 we've found that standard Golang's SDK doesn't provide support of the saltLength: 0, instead it always tries to generate salt with the maximum length.

This led us for the patch to WebPlatfrom tests: https://github.com/grafana/xk6-webcrypto/blob/main/webcrypto/tests/wpt-patches/WebCryptoAPI__sign_verify__rsa.js.patch

Since some use cases could actually try to use the lengths of salt 0 we need to issue a log warning user that the actual behavior of our implementation is different.

edit(@mstoykov): After some discussion the idea is currently to throw an exception instead of just log a warning.

Why?

It improves UX and makes implementation predictable.

Guide contributeur

Stack technique
gojavascript
Domaine
backendsecurity
Type d'issue
feature
DifficultéDifficulté estimée pour un nouveau contributeur, de 1 pour un très petit changement à 5 pour un travail expert.
3
Temps estiméFourchette de temps approximative pour investiguer, implémenter, tester et préparer une pull request.
1-3 hours
Statut d'activitéDisponibilité apparente de l'issue : fraîche, active, ancienne, bloquée ou en attente d'un mainteneur.
active
ClartéClarté avec laquelle l'issue explique le changement attendu, les critères d'acceptation et la prochaine étape.
mostly clear
Prérequis
GoWebCrypto APIRSA PSS
Accessibilité débutantScore de 1 à 100 estimant l'accessibilité de cette issue pour un premier contributeur.
40
Direction de recherche
The issue requires modifying the RSA PSS sign/verify implementation in Go to throw an exception when saltLength is 0. Review the discussion in the issue comments, especially the linked patch in xk6 webcrypto repository. The change should be in the file handling WebCrypto operations, likely in the xk6 webcrypto submodule or a similar location. Ensure the exception matches the WebCrypto specification.