Skip to content

GitLab

Commit bf79471e authored by Steven Allen's avatar Steven Allen
Browse files
Options

fix(key size): forbid small openssl RSA keys 

Also, add a test.
parent 2f75277a
Hide whitespace changes
Inline Side-by-side
Showing with 32 additions and 4 deletions
crypto/rsa_openssl.go
View file @ bf79471e
......@@ -43,6 +43,9 @@ func UnmarshalRsaPrivateKey(b []byte) (PrivKey, error) {
if err != nil {
return nil, err
}
if 8*key.key.Size() < MinRsaKeyBits {
return nil, ErrRsaKeyTooSmall
}
if key.Type() != RSA {
return nil, errors.New("not actually an rsa public key")
}
......@@ -55,6 +58,9 @@ func UnmarshalRsaPublicKey(b []byte) (PubKey, error) {
if err != nil {
return nil, err
}
if 8*key.key.Size() < MinRsaKeyBits {
return nil, ErrRsaKeyTooSmall
}
if key.Type() != RSA {
return nil, errors.New("not actually an rsa public key")
}
......
crypto/rsa_test.go
View file @ bf79471e
......@@ -40,10 +40,32 @@ func TestRSABasicSignAndVerify(t *testing.T) {
}
func TestRSASmallKey(t *testing.T) {
_, _, err := GenerateRSAKeyPair(384, rand.Reader)
_, _, err := GenerateRSAKeyPair(MinRsaKeyBits/2, rand.Reader)
if err != ErrRsaKeyTooSmall {
t.Fatal("should have refused to create small RSA key")
}
MinRsaKeyBits /= 2
badPriv, badPub, err := GenerateRSAKeyPair(MinRsaKeyBits, rand.Reader)
if err != nil {
t.Fatalf("should have succeeded, got: %s", err)
}
pubBytes, err := MarshalPublicKey(badPub)
if err != nil {
t.Fatal(err)
}
privBytes, err := MarshalPrivateKey(badPriv)
if err != nil {
t.Fatal(err)
}
MinRsaKeyBits *= 2
_, err = UnmarshalPublicKey(pubBytes)
if err != ErrRsaKeyTooSmall {
t.Fatal("should have refused to unmarshal a weak key")
}
_, err = UnmarshalPrivateKey(privBytes)
if err != ErrRsaKeyTooSmall {
t.Fatal("should have refused to unmarshal a weak key")
}
}
func TestRSASignZero(t *testing.T) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment