-
Notifications
You must be signed in to change notification settings - Fork 164
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for RSA-PSS (PS256, PS384, PS512) signatures #72
Comments
I answer to myself: Both versions are still not officially released, and it will take a little bit longer to be available in the distribs, so I guess the better approach is to wait a little bit longer. Although, if I'm right, the changes would look like: Include file// include/jwt.h insert on line 62
JWT_ALG_PS256,
JWT_ALG_PS384,
JWT_ALG_PS512, GnuTLS// libjwt/jwt-gnutls.c insert line 150
case JWT_ALG_PS256:
alg = GNUTLS_DIG_SHA256;
pk_alg = GNUTLS_PK_RSA_PSS;
break;
case JWT_ALG_PS384:
alg = GNUTLS_DIG_SHA384;
pk_alg = GNUTLS_PK_RSA_PSS;
break;
case JWT_ALG_PS512:
alg = GNUTLS_DIG_SHA512;
pk_alg = GNUTLS_PK_RSA_PSS;
break;
// And also change the function jwt_verify_sha_pem accordingly OpenSSL// libjwt/jwt-openssl.c insert line 198
/* RSA-PSS */
case JWT_ALG_PS256:
alg = EVP_sha256();
type = EVP_PKEY_RSA_PSS;
break;
case JWT_ALG_PS384:
alg = EVP_sha384();
type = EVP_PKEY_RSA_PSS;
break;
case JWT_ALG_PS512:
alg = EVP_sha512();
type = EVP_PKEY_RSA_PSS;
break;
// Make similar inserts in function jwt_verify_sha_pem |
I am able to sign and verify jwt using RSA-PSS algorithm using the GnuTLS backend! (spoiler alert: it's not as easy as I thought in the post above... :p ) Now I need to complete the openssl backend but I'm less fluent in openssl library than in gnutls library. @benmcollins (and others), if you're willing to help and have time to help on the openssl part, I'd be very grateful :-) |
Since you have test cases, I should be able to get this setup quickly. JWT.io has PS256/384 tests so I can validate against that. |
Thanks, jwt.io was helpful to me too. |
@benmcollins , do you want me to open a pull request to your repo, so you can continue from my code in a new branch? |
Completed in current code base. |
To complete the jwa support, libjwt should also support RSA-PSS signatures.
I have to admit, even if it seems easy to add, the RSA-PSS algorithm support is quite new in OpenSSL and GnuTLS librairies.
Do you think it's a good idea at the time?
The text was updated successfully, but these errors were encountered: