oracle / oracle/oci-python-sdk
Do not use pkcs1v15 for signature
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 474
- Forks
- 321
- Avg merge
- 23m
- Merged PRs (30d)
- 4
Description
Message signatures should be populated in a more secure way using pss.
Code is located at:https://github.com/oracle/oci-python-sdk/blob/22fd62c8dbbd1aaed6b75754ec1ba8a3c16a4e5a/src/oci/_vendor/jwt/algorithms.py#L378
You can refer to cryptography for pkcs1v15 specifications, https://cryptography.io/en/latest/limitations/#rsa-pkcs1-v1-5-constant-time-decryption
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/oci/_vendor/jwt/algorithms.py at the referenced line and review how message signatures are populated. Consult the linked cryptography PKCS#1 v1.5 specifications, then verify that the implementation uses PSS and that existing signature behavior remains covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100