Repository navigation
Gate PKCS #1 v1.5 as opt-in via feature=pkcs1v15 - #778
Merged
Merged
Conversation
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
pinkforest
commented
Nov 6, 2026
| prop_assert!(verifying_key.verify(&msg, &signature).is_ok()); | ||
| } | ||
|
|
||
| // TODO(tarcieri): debug why these are failing |
Contributor
Author
There was a problem hiding this comment.
There was TODO for PSS proptest here
This was referenced Nov 6, 2026
Member
|
I like the idea though I think the feature can probably just be called |
Contributor
Author
|
Changed to |
pinkforest
changed the title
feature=legacy-pkcs1v15feature=pkcs1v15
tarcieri
approved these changes
Nov 6, 2026
kaidokert
added a commit
to kaidokert/RSA
that referenced
this pull request
Nov 8, 2026
* Replace `CryptoRng` with `TryCryptoRng` (RustCrypto#779) Adds baseline support for handling RNG failures as errors. Fork adaptation: the remaining `CryptoRng` bounds on the fork's generic encrypting and signing keys move to `TryCryptoRng` as well. The upstream message's issue reference is dropped. (cherry picked from commit 9c26587) * Gate PKCS #1 v1.5 as opt-in via `feature=pkcs1v15` (RustCrypto#778) Fork adaptation: the gate covers the heapless PKCS#1 v1.5 path as well, and the feature stays off by default, as upstream. The fork's consumers that use it enable it: the modmath examples (required features), the footprint, ct-verify and checkct crates, and the marvin-toolkit. The modmath backend's PKCS#1 v1.5 tests and the heapless smoke test are gated on it. Upstream's README hunk goes to UPSTREAM_README.md; our README notes the opt-in. The test-file conflicts keep the fork's versions of tests that round 1 left out. The upstream message's issue reference is dropped. (cherry picked from commit f551f4c) * Build docs.rs with --all-features (cherry picked from commit 942ca23) * .codecov.yml: initial configuration (RustCrypto#783) (cherry picked from commit 5937253) * CI: add codecov coverage job Ports upstream's coverage job, skipped in the first catch-up round and recorded as merged by it, now that the fork reports to codecov too. Coverage runs for `rsa_heapless` with all features. The upload passes the repository's `CODECOV_TOKEN`, which a fork repository needs and upstream's job does not set. Locally the job measures 90.9% line coverage against the 90% project target in `.codecov.yml`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Tony Arcieri <bascule@gmail.com> Co-authored-by: pinkforest(she/her) <36498018+pinkforest@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Merged
tarcieri
added a commit
that referenced
this pull request
Nov 8, 2026
## Security - Replace `num-bigint-dig` with `crypto-bigint` for constant-time modular exponentiation (#394) - Redact private-key components from `Debug` output (#480) - Harden private-key operations following `draft-irtf-cfrg-rsa-guidance` (#710, #715, #739, #751, #752, #755, #756, #758, #770, #771, #773) - Zeroize stored secret-prime Montgomery parameters in `PrecomputedValues` (#716) - Implement PKCS#1 v1.5 implicit rejection: return deterministic synthetic plaintext on invalid padding instead of exposing a padding error and with it a sidechannel (#726, #729, #749) ## Added - PKCS#8/SPKI decoding for PSS keys, including `id-RSASSA-PSS` algorithm identifiers (#424) - `pss::VerifyingKey::salt_len` and opt-in automatic salt-length detection via `new_with_auto_salt_len` (#448, #546) - Wycheproof test coverage for PKCS#1 v1.5, PSS, and OAEP (#477, #740) - `PublicKeyParts::n_bytes` and `e_bytes` serialization helpers (#519) - Multipart signing trait implementations for PKCS#1 v1.5 and PSS (#525) - `Clone` and `core::error::Error` implementations for `Error` (#530, #694) - `PrivateKey::as_public_key` accessor (#592) - Algorithm-specific inherent methods on `PrivateKey` and `PublicKey` for OAEP encryption/decryption and PKCS#1 v1.5/PSS signing/verification, including prehash and explicit-RNG variants (#638) - `PrivateKey::from_components_with_large_exponent`, gated on `hazmat` (#648) - Constant-time validation harness using `cargo checkct`/BINSEC (#732, #733, #749, #756, #771, #773) - `PrivateKey::from_components_with_wide_primes` for unbalanced two-prime keys, which ordinary constructors now reject (#755) - `TryFrom<BitStringRef<'_>>` for PKCS#1 v1.5 and PSS signatures (#764) - `crypto_common::Generate` implementation and `Generate` re-export for generating 3072-bit keys with public exponent 65537 (#780) ## Changed - Replace `BigUint` in the public API with `BoxedUint`; return `NonZero<BoxedUint>` for the modulus and `Odd<BoxedUint>` for prime factors (#394, #735) - Use `crypto-primes` for prime generation (#394) - Use DER-based key encodings and hex-or-binary serde representations via `serdect`; extend serde support to OAEP, PKCS#1 v1.5, and PSS wrapper types (#420) - Accept arbitrary byte strings as OAEP labels (#467) - Gate PKCS#1/PKCS#8/SPKI support on the default-enabled `encoding` feature; `std` no longer implicitly enables encoding dependencies (#537, #543) - Enforce a 1024-bit minimum for key generation and default public-key construction/decoding; add `PublicKey::new_with_size_limits` and `hazmat`-gated unchecked key generation (#576, #760) - Bump `pkcs1` to v0.8; `pkcs8` to v0.11; `spki` to v0.8; `serdect` to v0.4 (#584, #684, #688, #766) - Make `Oaep` and `Pss` generic over their digest types instead of using `DynDigest` (#593) - Bump `rand_core` to v0.10, `crypto-common` to v0.2, `digest` to v0.11, and `signature` to v3 (#650, #671, #693) - Remove a redundant allocation during OAEP decryption (#659) - Improve encryption and verification performance by bounding exponentiation to the public exponent's bit length (#662) - Bump `crypto-bigint` to v0.7.10 and `crypto-primes` to v0.7 (#673, #766) - Raise the default maximum public-key modulus size to 8192 bits (#681) - Bump `sha1` and `sha2` to v0.11 (#683) - Store PKCS#1 v1.5 and PSS signatures as byte strings, preserving their encoded width (#722, #723) - MSRV 1.87; Rust 2024 edition (#731, #757) - Enable `getrandom` by default and use the system RNG for blinding in default decryption and signing paths (#739, #758) - Limit signature decoding to 1024 bytes by default; add `Signature::from_bytes_with_max_len` for explicit limits (#767) - Require the opt-in `pkcs1v15` feature for PKCS#1 v1.5 encryption and signatures (#778) - Accept fallible RNGs through `TryCryptoRng` and propagate RNG failures as errors (#779) - Rename `RsaPrivateKey` and `RsaPublicKey` to `PrivateKey` and `PublicKey`, retaining the old names as deprecated aliases (#781) ## Deprecated - `pss::BlindedSigningKey` in favor of `pss::SigningKey`, which now applies blinding by default (#758) - `PublicKey::new_with_max_size` in favor of `PublicKey::new_with_size_limits` (#760) ## Removed - `nightly` and `u64_digit` features associated with `num-bigint-dig` (#394) - Deprecated `Pkcs1v15Sign::new_raw` and `pkcs1v15` `*_with_prefix` constructors (#524) - Separate `pem` feature; PEM support is included with `encoding` (#537) - Optional `sha2` feature; SHA-2 support is now always enabled (#749) ## Fixed - Honor explicit larger-key construction limits during cryptographic operations, including OAEP decryption (#441, #595) - PKCS#1 v1.5 `SigningKey::from` and `VerifyingKey::from` now use the digest prefix consistent with `new` (#472, #498) - Check the modulus's actual bit length instead of its storage precision when enforcing size limits (#529) - Retry zero blinding factors instead of replacing them with one (#653) - Reject private-key factors less than or equal to one, even or repeated factors, and private exponents greater than or equal to the modulus (#655, #738, #772, #774) - Reject PSS salt lengths that cannot be represented by the `AlgorithmIdentifier` encoder instead of truncating them (#704) - Apply RFC 8017 encoded-message width rules for PSS, including moduli whose bit length is congruent to 1 modulo 8 (#725) - Return verification errors instead of panicking for undersized PSS encoded messages and overflowing salt lengths (#769) - Propagate CRT precomputation errors from private-key constructors (#782)
This was referenced Nov 9, 2026
Closed
plusvic
pushed a commit
to VirusTotal/yara-x
that referenced
this pull request
Nov 10, 2026
Fixes #865. - Require `rsa` 0.10.0 with the `pkcs1v15` feature, where `Pkcs1v15Sign` now lives (RustCrypto/RSA#778). - Replace the deprecated `rsa::RsaPublicKey` alias with `rsa::PublicKey`. - Keep accepting RSA keys shorter than 1024 bits. `rsa` 0.10.0 rejects them when decoding, so keys are now decoded with `rsa::pkcs1` and built with `PublicKey::new_with_size_limits`, as the `rsa` docs suggest. The rest of `rsa`'s validation is unchanged, including the algorithm-identifier checks for `SubjectPublicKeyInfo` keys.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #777