You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by "seanjmullan (via GitHub)" <gi...@apache.org> on 2023/09/06 17:45:50 UTC
[GitHub] [santuario-xml-security-java] seanjmullan opened a new pull request, #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
seanjmullan opened a new pull request, #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206
This change includes more portable support for the RSSSA-PSS algorithms without parameters defined in RFC 9231.
It instantiates java.security.Signature objects with an "RSASSA-PSS" algorithm and initializes the default parameters using a `PSSParameterSpec` object. This approach works for both the JDK and BouncyCastle JCE providers.
If this approach does not work for some reason, it falls back to instantiating Signature objects using algorithms like "SHA256withRSAandMGF1" (however these algorithm names are not standard as per the Java Security Standard Algorithm Names specification, so may not work for certain JCE providers, such as the ones in the JDK).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] seanjmullan commented on pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan commented on PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206#issuecomment-1713938858
> @seanjmullan Reminder to backport to 3.0.x-fixes and 2.3.x-fixes
Yes, thanks for the reminder.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] seanjmullan commented on a diff in pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan commented on code in PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206#discussion_r1318672899
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -682,7 +743,12 @@ Type getAlgorithmType() {
}
Review Comment:
Good idea- fixed.
##########
src/main/java/org/apache/xml/security/algorithms/implementations/SignatureBaseRSA.java:
##########
@@ -364,10 +369,53 @@ public String engineGetURI() {
}
}
+ public abstract static class SignatureBaseRSAPSS extends SignatureBaseRSA {
+
+ public SignatureBaseRSAPSS() throws XMLSignatureException {
+ super();
+ }
+
+ public SignatureBaseRSAPSS(Provider provider) throws XMLSignatureException {
+ super(provider);
+ }
+
+ @Override
+ Signature getSignature(Provider provider, String algorithmID)
+ throws XMLSignatureException {
+ try {
+ Signature sig;
+ if (provider == null) {
+ String providerId = JCEMapper.getProviderId();
+ if (providerId == null) {
+ sig = Signature.getInstance("RSASSA-PSS");
+ } else {
+ sig = Signature.getInstance("RSASSA-PSS", providerId);
+ }
+ } else {
+ sig = Signature.getInstance("RSASSA-PSS", provider);
+ }
+ try {
+ sig.setParameter(getPSSParameterSpec());
+ } catch (InvalidAlgorithmParameterException e) {
+ throw new NoSuchAlgorithmException("Should not happen", e);
+ }
+ return sig;
+ } catch (NoSuchAlgorithmException | NoSuchProviderException e) {
+ return super.getSignature(provider, algorithmID);
+ }
+ }
+
+ abstract PSSParameterSpec getPSSParameterSpec();
+ }
+
/**
* Class SignatureRSASHA1MGF1
*/
- public static class SignatureRSASHA1MGF1 extends SignatureBaseRSA {
+ public static class SignatureRSASHA1MGF1 extends SignatureBaseRSAPSS {
+
+ private static PSSParameterSpec spec
Review Comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] coheigea commented on pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "coheigea (via GitHub)" <gi...@apache.org>.
coheigea commented on PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206#issuecomment-1713190557
@seanjmullan Reminder to backport to 3.0.x-fixes and 2.3.x-fixes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] wangweij commented on a diff in pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "wangweij (via GitHub)" <gi...@apache.org>.
wangweij commented on code in PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206#discussion_r1317647363
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -660,7 +712,12 @@ Type getAlgorithmType() {
}
}
- static final class SHA1withRSAandMGF1 extends AbstractRSASignatureMethod {
+ static final class SHA1withRSAandMGF1 extends AbstractRSAPSSSignatureMethod {
+
+ private static PSSParameterSpec spec
Review Comment:
These can be `final`.
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -682,7 +743,12 @@ Type getAlgorithmType() {
}
Review Comment:
How about we move the `getAlgorithmType` method into `AbstractRSASignatureMethod`? All RSA and RSASSA-PSS signature methods return `Type.RSA`. We can even do similar change for `AbstractDSASignatureMethod`, `AbstractEDDSASignatureMethod`, and `AbstractECDSASignatureMethod`.
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -362,6 +380,40 @@ byte[] preVerifyFormat(Key key, byte[] sig) {
}
}
+ abstract static class AbstractRSAPSSSignatureMethod
+ extends AbstractRSASignatureMethod {
+
+ AbstractRSAPSSSignatureMethod(AlgorithmParameterSpec params)
+ throws InvalidAlgorithmParameterException {
+ super(params);
+ }
+
+ AbstractRSAPSSSignatureMethod(Element dmElem) throws MarshalException {
+ super(dmElem);
+ }
+
+ public abstract PSSParameterSpec getPSSParameterSpec();
+
+ @Override
+ Signature getSignature(Provider p)
+ throws NoSuchAlgorithmException {
+ try {
+ Signature s = (p == null)
+ ? Signature.getInstance("RSASSA-PSS")
+ : Signature.getInstance("RSASSA-PSS", p);
+ try {
+ s.setParameter(getPSSParameterSpec());
+ } catch (InvalidAlgorithmParameterException e) {
+ throw new NoSuchAlgorithmException("Should not happen", e);
+ }
+ return s;
+ } catch (NoSuchAlgorithmException nsae) {
Review Comment:
How about `return super.getSignature(p);`?
##########
src/main/java/org/apache/xml/security/algorithms/implementations/SignatureBaseRSA.java:
##########
@@ -364,10 +369,53 @@ public String engineGetURI() {
}
}
+ public abstract static class SignatureBaseRSAPSS extends SignatureBaseRSA {
+
+ public SignatureBaseRSAPSS() throws XMLSignatureException {
+ super();
+ }
+
+ public SignatureBaseRSAPSS(Provider provider) throws XMLSignatureException {
+ super(provider);
+ }
+
+ @Override
+ Signature getSignature(Provider provider, String algorithmID)
+ throws XMLSignatureException {
+ try {
+ Signature sig;
+ if (provider == null) {
+ String providerId = JCEMapper.getProviderId();
+ if (providerId == null) {
+ sig = Signature.getInstance("RSASSA-PSS");
+ } else {
+ sig = Signature.getInstance("RSASSA-PSS", providerId);
+ }
+ } else {
+ sig = Signature.getInstance("RSASSA-PSS", provider);
+ }
+ try {
+ sig.setParameter(getPSSParameterSpec());
+ } catch (InvalidAlgorithmParameterException e) {
+ throw new NoSuchAlgorithmException("Should not happen", e);
+ }
+ return sig;
+ } catch (NoSuchAlgorithmException | NoSuchProviderException e) {
+ return super.getSignature(provider, algorithmID);
+ }
+ }
+
+ abstract PSSParameterSpec getPSSParameterSpec();
+ }
+
/**
* Class SignatureRSASHA1MGF1
*/
- public static class SignatureRSASHA1MGF1 extends SignatureBaseRSA {
+ public static class SignatureRSASHA1MGF1 extends SignatureBaseRSAPSS {
+
+ private static PSSParameterSpec spec
Review Comment:
Make `final`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] seanjmullan commented on a diff in pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan commented on code in PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206#discussion_r1318672140
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -660,7 +712,12 @@ Type getAlgorithmType() {
}
}
- static final class SHA1withRSAandMGF1 extends AbstractRSASignatureMethod {
+ static final class SHA1withRSAandMGF1 extends AbstractRSAPSSSignatureMethod {
+
+ private static PSSParameterSpec spec
Review Comment:
Fixed.
##########
src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java:
##########
@@ -362,6 +380,40 @@ byte[] preVerifyFormat(Key key, byte[] sig) {
}
}
+ abstract static class AbstractRSAPSSSignatureMethod
+ extends AbstractRSASignatureMethod {
+
+ AbstractRSAPSSSignatureMethod(AlgorithmParameterSpec params)
+ throws InvalidAlgorithmParameterException {
+ super(params);
+ }
+
+ AbstractRSAPSSSignatureMethod(Element dmElem) throws MarshalException {
+ super(dmElem);
+ }
+
+ public abstract PSSParameterSpec getPSSParameterSpec();
+
+ @Override
+ Signature getSignature(Provider p)
+ throws NoSuchAlgorithmException {
+ try {
+ Signature s = (p == null)
+ ? Signature.getInstance("RSASSA-PSS")
+ : Signature.getInstance("RSASSA-PSS", p);
+ try {
+ s.setParameter(getPSSParameterSpec());
+ } catch (InvalidAlgorithmParameterException e) {
+ throw new NoSuchAlgorithmException("Should not happen", e);
+ }
+ return s;
+ } catch (NoSuchAlgorithmException nsae) {
Review Comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [santuario-xml-security-java] seanjmullan merged pull request #206: SANTUARIO-604: Use PSSParameterSpec for RSASSA-PSS without parameters SignatureMethod URIs
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan merged PR #206:
URL: https://github.com/apache/santuario-xml-security-java/pull/206
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org