crypto/x509: RSAES-OAEP support

[DenisKarch]

x509 currently does not support parsing rsaesoap pub keys.
Use case is calling x509 to extract the public EK from TPMs for verification purposes.
There are many old TPM units that use this key type.

[agnivade]

/cc @FiloSottile

[bcmills]

CC @agl

[FiloSottile]

I'm assuming this is about RSAES-OAEP public keys, specified in RFC 4055 and 5756.

I imagine these keys are encryption only, so not very useful for TLS.

Note that we don't even support certificate keys with id-RSASSA-PSS OID at the moment.

[DenisKarch]

Yes both your assumptions are correct. TPM manufacturers have since switched to using rsaEncryption keys, however a significant portion of machines still have TPMs whose public keys are RSAES-OAEP. From what I can gather the difficulty with adding proper support for RSAES-OAEP public keys is that their parameters have non-integer default values (which is not currently supported). For our purposes we do not need to parse the parameters so leaving them as a RawValue is fine.
(I currently have a "working" hack in place that parses the parameters somewhat successfully)

[FiloSottile]

The main problem with id-RSASSA-PSS and id-RSAES-OAEP keys is that if we parse them into a *rsa.PublicKey, all current crypto/x509 users (including crypto/tls) will accept them and treat them as if they were rsaEncryption, which might be incorrect and unexpected, so we need some other wrapper time or something like that.

For parsing we can use golang.org/x/crypto/cryptobyte if encoding/asn1 does not fit.