Add support for RSA-PSS (PS256, PS384, PS512) signatures

[babelouest]

To complete the jwa support, libjwt should also support RSA-PSS signatures.

I have to admit, even if it seems easy to add, the RSA-PSS algorithm support is quite new in OpenSSL and GnuTLS librairies.

Do you think it's a good idea at the time?

[babelouest]

I answer to myself:
In GnuTLS, RSA-PSS signing and verification is available in the 3.6 branch but not in the 3.5 branch
In OpenSSL, RSA-PSS is available in the 1.1.1 branch but not in the 1.1.0 branch

Both versions are still not officially released, and it will take a little bit longer to be available in the distribs, so I guess the better approach is to wait a little bit longer.

Although, if I'm right, the changes would look like:

Include file

// include/jwt.h insert on line 62
	JWT_ALG_PS256,
	JWT_ALG_PS384,
	JWT_ALG_PS512,

GnuTLS

// libjwt/jwt-gnutls.c insert line 150
	case JWT_ALG_PS256:
		alg = GNUTLS_DIG_SHA256;
		pk_alg = GNUTLS_PK_RSA_PSS;
		break;
	case JWT_ALG_PS384:
		alg = GNUTLS_DIG_SHA384;
		pk_alg = GNUTLS_PK_RSA_PSS;
		break;
	case JWT_ALG_PS512:
		alg = GNUTLS_DIG_SHA512;
		pk_alg = GNUTLS_PK_RSA_PSS;
		break;
// And also change the function jwt_verify_sha_pem accordingly

OpenSSL

// libjwt/jwt-openssl.c insert line 198
	/* RSA-PSS */
	case JWT_ALG_PS256:
		alg = EVP_sha256();
		type = EVP_PKEY_RSA_PSS;
		break;
	case JWT_ALG_PS384:
		alg = EVP_sha384();
		type = EVP_PKEY_RSA_PSS;
		break;
	case JWT_ALG_PS512:
		alg = EVP_sha512();
		type = EVP_PKEY_RSA_PSS;
		break;
// Make similar inserts in function jwt_verify_sha_pem

[babelouest]

I am able to sign and verify jwt using RSA-PSS algorithm using the GnuTLS backend!
https://github.com/babelouest/libjwt/tree/rsa-pss

(spoiler alert: it's not as easy as I thought in the post above... :p )

Now I need to complete the openssl backend but I'm less fluent in openssl library than in gnutls library.

@benmcollins (and others), if you're willing to help and have time to help on the openssl part, I'd be very grateful :-)

[benmcollins]

Since you have test cases, I should be able to get this setup quickly. JWT.io has PS256/384 tests so I can validate against that.

[babelouest]

Thanks, jwt.io was helpful to me too.
I found this SO question that seems helpful to understand rsa-pss sign/verification with libssl: https://stackoverflow.com/questions/44546272/activate-padding-and-salt
Otherwise, the documentation seems very slim...

[babelouest]

@benmcollins , do you want me to open a pull request to your repo, so you can continue from my code in a new branch?

[benmcollins]

Completed in current code base.