Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added ability to Encrypt and Decrypt for RSA PKCS1 padding. #32

Closed
wants to merge 1 commit into from

Conversation

dunkleyr
Copy link

Added logic to the Encrypt and Decrypt overrides for pkcs1 padding. I added some test cases to cover the added code, but the software HSM doesn't support it so the tests were commented out.

jariq added a commit that referenced this pull request Apr 21, 2024
@jariq
Copy link
Member

jariq commented Apr 21, 2024

Thanks for the PR @dunkleyr.

SoftHSM supports both RSA encryption and RSA decryption with PKCS#1 padding just fine. Code submitted in this PR was incorrect because it was trying to perform encryption with private key while it should be performed with public key.

I've just committed correct implementation in 8b32c33 so I'm closing this PR without merge.

@jariq jariq closed this Apr 21, 2024
@dunkleyr
Copy link
Author

There are scenarios where you would want to encrypt with the private key as opposed to the public key. It would be nice if the library supported both, but I understand that was not the intent of these specific methods.

@jariq
Copy link
Member

jariq commented Apr 23, 2024

@dunkleyr I am not sure I understand your comment.

RSA is asymmetric public/private key based cryptosystem. In my experience RSA encryption is always performed with public key and RSA decryption is always performed with private key. If it's the other way around, then it's not encryption/decryption but signing/verification. I've also never seen PKCS#11 implementation that would allow you to call C_Encrypt with private RSA key.

Can you please provide an example of a scenario you mentioned (scenario where you would encrypt data with a private RSA key)?
Can you please provide an example of PKCS#11 library that allows you to call C_Encrypt with private RSA key?

@dunkleyr
Copy link
Author

Signing/Verification is the scenario I am referring to, but in cases where the full process of SignHash and VerifyHash methods can't be used. I don't remember the exact scenario since it has been 2 years, but I am guessing it was to encrypt ("sign") a hash that would be decrypted ("verified") at a low level (FPGA maybe or secure boot?) for integrity purposes (not concealment). It might have been the PKCS1 Digest info that it couldn't do, but I can't remember for sure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants