Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2026-06-27 19:30:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/rsa: bypass Go+BoringCrypto for small, insecure, flaky keys

Browse source 
Fixes #74326

Change-Id: I103e4ac0421124e11cb89b44bf6f1a686a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/776500
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: David Chase <drchase@google.com>
This commit is contained in:
Filippo Valsorda 2026-05-10 12:46:03 +02:00 • committed by Gopher Robot
parent c2ecd421b8
commit 03d1f8efc8
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/crypto/rsa/fips.go
View file

@ -71,14 +71,16 @@ func SignPSS(random io.Reader, priv *PrivateKey, hash crypto.Hash, digest []byte
hash = opts.Hash
}
if boring.Enabled && rand.IsDefaultReader(random) {
if boring.Enabled && rand.IsDefaultReader(random) && priv.N.BitLen() >= 1024 {
bkey, err := boringPrivateKey(priv)
if err != nil {
return nil, err
}
return boring.SignRSAPSS(bkey, hash, digest, opts.saltLength())
}
boring.UnreachableExceptTests()
if priv.N.BitLen() >= 1024 {
boring.UnreachableExceptTests()
}
if !hash.Available() {
return nil, errors.New("crypto/rsa: requested hash function unavailable: " + hash.String())
@ -281,7 +283,7 @@ func decryptOAEP(hash, mgfHash hash.Hash, priv *PrivateKey, ciphertext []byte, l
return nil, err
}
if boring.Enabled {
if boring.Enabled && priv.N.BitLen() >= 1024 {
k := priv.Size()
if len(ciphertext) > k ||
k < hash.Size()*2+2 {
@ -343,7 +345,7 @@ func SignPKCS1v15(random io.Reader, priv *PrivateKey, hash crypto.Hash, hashed [
return nil, err
}
if boring.Enabled {
if boring.Enabled && priv.N.BitLen() >= 1024 {
bkey, err := boringPrivateKey(priv)
if err != nil {
return nil, err

4
src/crypto/rsa/pkcs1v15.go
View file

@ -115,7 +115,7 @@ func DecryptPKCS1v15(random io.Reader, priv *PrivateKey, ciphertext []byte) ([]b
return nil, err
}
if boring.Enabled {
if boring.Enabled && priv.N.BitLen() >= 1024 {
bkey, err := boringPrivateKey(priv)
if err != nil {
return nil, err
@ -221,7 +221,7 @@ func decryptPKCS1v15(priv *PrivateKey, ciphertext []byte) (valid int, em []byte,
return 0, nil, 0, err
}
if boring.Enabled {
if boring.Enabled && priv.N.BitLen() >= 1024 {
var bkey *boring.PrivateKeyRSA
bkey, err = boringPrivateKey(priv)
if err != nil {