grafana/k6

webcrypto: Throw exception on `saltLength: 0` for RSA PSS sign/verify

Open

#4,265 opened on Oct 30, 2024

View on GitHub
 (14 comments) (0 reactions) (1 assignee)Go (30,564 stars) (1,537 forks)batch import
area: webcryptogood first issuehelp wanted

Description

What?

While implementing support of RSA grafana/xk6-webcrypto#85 we've found that standard Golang's SDK doesn't provide support of the saltLength: 0, instead it always tries to generate salt with the maximum length.

This led us for the patch to WebPlatfrom tests: https://github.com/grafana/xk6-webcrypto/blob/main/webcrypto/tests/wpt-patches/WebCryptoAPI__sign_verify__rsa.js.patch

Since some use cases could actually try to use the lengths of salt 0 we need to issue a log warning user that the actual behavior of our implementation is different.

edit(@mstoykov): After some discussion the idea is currently to throw an exception instead of just log a warning.

Why?

It improves UX and makes implementation predictable.

Contributor guide

Tech stack
gojavascript
Domain
backendsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
GoWebCrypto APIRSA PSS
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
The issue requires modifying the RSA PSS sign/verify implementation in Go to throw an exception when saltLength is 0. Review the discussion in the issue comments, especially the linked patch in xk6 webcrypto repository. The change should be in the file handling WebCrypto operations, likely in the xk6 webcrypto submodule or a similar location. Ensure the exception matches the WebCrypto specification.