Maximum modulus size
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- rust
- Domain
- cryptography, security
Research direction
No file or test is named. Start by tracing the signature and RSA private-key parsing paths before conversion to BigUint, then review the existing PKCS#1v15 and PSS modulus checks. Done means agreeing on a maximum size, enforcing it before parsing, and adding coverage for oversized signatures and private keys.
Written by the indexing model from the issue text.
Description
In #349 I suggested adopting some sort of ceiling on the size of integers that are acceptable for signatures, i.e. a maximum modulus size. This would prevent parsing some large amount of data that doesn't make sense as a signature to an extremely large integer.
While we do have checks that the signature does not exceed the modulus for a given public key in PKCS#1v15 and PSS now (I believe?), these checks aren't applied until signature verification time, whereas I think this sort of sanity limit would be better applied before we ever parse to a BigUint.
It could also form an upper bound on what we consider acceptable as an RSA private key, where we currently have no limit.
Perhaps 16384-bits would be acceptable? /cc @dignifiedquire
- Dominant language
- Rust
- Stars
- 673
- Forks
- 190
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from RustCrypto/RSA
-
Bump MSRV to 1.89 Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
RustCrypto/RSA#707 · 2 comments · 1 reaction ·
-
Difficulty 3/5 Half a day Newbie friendliness 74/100
RustCrypto/RSA#703 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
RustCrypto/RSA#686 · 4 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
RustCrypto/RSA#647 · 9 comments · 1 reaction ·
-
broken rust docs Open
Difficulty 4/5 3-5 days Newbie friendliness 35/100
RustCrypto/RSA#641 · 3 reactions ·
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100