rsassa-pss signatures not supported

[chiasottis]

I'm using a certificate stored on a Yubikey to authenticate with a server. After enabling TLS 1.3, the flow broke because the TLS handshake attempts to use rsassa-pss and this library prevents that here:

    if _, ok := opts.(*rsa.PSSOptions); ok {
        return nil, fmt.Errorf("rsassa-pss signatures not supported")
    }

Disabling rsassa-pss is not possible, unfortunately.

Interestingly, if I comment out the code above, the Yubikey seems to support this just fine, and the authentication succeeds.

What was the historical reason for introducing the check above? Was it related to the issues that golang had introducing support for rsassa-pss? Or maybe older Yubikeys did not support it?

Could removing this check be an option?

[ericchiang]

Hey! I don't remember exactly why this was omitted, but I also don't see any way for us to pass the salt length to the YubiKey:

https://pkg.go.dev/crypto/rsa#PSSOptions https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf#page=117

For other protocols, like PKCS #11, there are additional parameters for the signing operation:

http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cs01/pkcs11-curr-v2.40-cs01.html#_Toc399398845

Maybe this is using the implicit rsa.PSSSaltLengthAuto value, and letting the card choose the salt length rather than the caller? What if you provide an implicit salt length, and https://pkg.go.dev/crypto/rsa#VerifyPSS?

[ericchiang]

This does remind me of similar issues with TPMs, which require automatic salt length values when using TLS 1.3

https://github.com/tpm2-software/tpm2-pkcs11/commit/7083a44dfa38de3540ec88fbccc73e68b9c51209

Maybe we should allow PSSOptions, but error if anything other than PSSSaltLengthAuto is set?

[ericchiang]

Good news, bad news

I seem to have gotten it working with https://github.com/go-piv/piv-go/pull/119. But I had to copy a significant portion of crypto/rsa to do it.

Probably going to need to figure out a subdirectory with appropriate licenses. Luckily if you're depending on this package, you're already okay using the crypto/rsa license.