dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
14.91k stars 4.63k forks source link

Investigate if RSA issue can happen with ECDSA/ECDH on OpenSSL < 3.0 #105175

Closed krwq closed 2 weeks ago

krwq commented 1 month ago

In https://github.com/dotnet/runtime/pull/104961 we've changed OpenSSL implementation of ECDsa and ECDH to be similar to RSA. RSA implementation had a workaround for OpenSSL issue which occurs only on some low versions of OpenSSL and it requires us checking if key is a private key explicitly rather than relying on OpenSSL API. See: https://github.com/dotnet/runtime/issues/53345#issuecomment-852264901 - we've added HasNoPrivateKey check in the Sign/Decrypt operations.

We need to verify if:

As part of this it would be good to add provider test cases as suggested per https://github.com/dotnet/runtime/pull/104961#pullrequestreview-2189457438

dotnet-policy-service[bot] commented 1 month ago

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones See info in area-owners.md if you want to be subscribed.