auth-asymmetric or sso only.Expand description
RSA public keys and RS256 / rsa-sha256 signature verification (no rsa crate).
RSA public keys and RS256 / rsa-sha256 signature verification (no rsa crate).
RSA public keys and RSASSA-PKCS1-v1_5 / SHA-256 signature verification —
everything rws does with RSA (RS256 JWTs, SAML rsa-sha256 signatures),
implemented in-crate.
This replaces the rsa crate, whose RUSTSEC-2023-0071 (“Marvin”: a timing
side channel in private-key operations) has no fixed release. rws never
holds an RSA private key: verification uses only public data — the key,
the message and the signature — so nothing secret can leak through
timing, and the arithmetic here needn’t be constant-time. It is pure Rust
(works on wasm32 too).
Verification follows RFC 8017 §8.2.2: the signature must be exactly the
modulus length and smaller than the modulus; s^e mod n is computed with
Montgomery multiplication; and the result must equal, byte for byte, the
expected encoding 00 01 FF…FF 00 || DigestInfo(SHA-256) || hash.
Comparing the whole encoded block (rather than parsing it) rules out the
classic padding-forgery tricks. Keys must be 2048–8192 bits with an odd
public exponent of at least 3.
Structs§
- RsaPublic
Key - An RSA public key, ready to verify signatures.