Default the pkcs11 code to use sha256 for OAEP padding #61
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fix a comment because the empty string of the hash defaults to sha1 and not sha256. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
stefanberger
force-pushed
the
pkcs11_to_sha256_default
branch
from
b179703
to
97dfb71
Compare
stefanberger
force-pushed
the
pkcs11_to_sha256_default
branch
5 times, most recently
from
323b585
to
6fde93a
Compare
stefanberger
changed the title
lumjjb
approved these changes
Apr 27, 2022
crypto/pkcs11/pkcs11helpers.go
Outdated
| // } , | ||
| // [...] | ||
| // } | ||
| // Note: More recent versions of this code explicityly write 'sha1' |
stefanberger
force-pushed
the
pkcs11_to_sha256_default
branch
2 times, most recently
from
3e20e9f
to
0d7f671
Compare
Remove the variable OAEPDefaultHash and explicitly store 'sha1' in the JSON's Hash field. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
In case the user doesn't set the environment variable OCICRYPT_OAEP_HASHALG sha256 will be used now. This breaks default usage with SoftHSM because the only hash it currently (v2.6.1) supports is sha1. So a user of SoftHSM now has to set the environment variable to 'sha1' and we have to adjust the test case because of this. SoftHSM link to OAEP only supporting sha1: https://github.com/opendnssec/SoftHSMv2/blob/7f99bedae002f0dd04ceeb8d86d59fc4a68a69a0/src/lib/SoftHSM.cpp#L3123-L3127 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
stefanberger
force-pushed
the
pkcs11_to_sha256_default
branch
from
0d7f671
to
dd06ac4
Compare
|
Thanks a lot @stefanberger @lumjjb for this. Can we get new release with this please? |
|
Before we release, want to make sure that we capture this change in the rust version as well @arronwy , any concerns of this from the rust side? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR modifies the pkcs11 code to default to sha256