PSS: Improve interoperability with optional auto salt length detection during verification #546
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Makes salt_len parameter optional in EMSA-PSS verification, defaulting to auto-detection by scanning for the 0x01 separator byte. Signing still requires explicit salt length specification.
Replace variable-time scanning with constant-time implementation. Eliminates early termination and data-dependent branching that could leak padding structure via timing side-channels.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds an optional method to automatically detect the salt length during RSA-PSS signature verification.
Should Fix: #361 and similar situations.
Problem
The crate currently requires a fixed salt length for PSS verification. This prevents verification of signatures where the salt length is not known beforehand, a situation not uncommon in interoperability contexts.
This capability was previously available but was removed in PR #294.
Solution
This change re-introduces salt length auto-detection as an explicit, opt-in feature. A new constructor,
VerifyingKey::new_with_auto_salt_len, creates a verifier that performs this detection during verification.Commit Structure
This PR consists of three commits:
new_with_auto_salt_lenand re-introduces the previous detection logic.Because salt length auto-detection is OpenSSL's default, it's likely that many systems were built without a mechanism to enforce or communicate a fixed salt length. Without this PR, it was impossible to reliably use this crate in my current project, and I suspect others face the same blocker. I've lost quite a bit of time dealing with seemingly random signature verification failures until I realized the crux of the problem.