search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Does not enforce key lengths required by RFC 7518 #1286

Closed asgeirn closed 2 years ago

asgeirn commented 2 years ago

JWA section 3.3 states:

This section defines the use of the RSASSA-PKCS1-v1_5 digital signature algorithm as defined in Section 8.2 of RFC 3447 [RFC3447] (commonly known as PKCS #1), using SHA-2 [SHS] hash functions.

A key of size 2048 bits or larger MUST be used with these algorithms.

JWA is stated as an implementation requirement in RFC 7519, section 8.

As a consequence, standards-compliant JWT libraries like JOSE refuse to validate access tokens issued using this library.

Sephster commented 2 years ago

The JWTs we issue aren't encrypted. They are just signed so I don't think we need to comply with that section of the RFC:

Support for encrypted JWTs is OPTIONAL. If an implementation provides encryption capabilities, of the encryption algorithms specified in [JWA], only RSAES-PKCS1-v1_5 with 2048-bit keys ("RSA1_5"), AES Key Wrap with 128- and 256-bit keys ("A128KW" and "A256KW"), and the composite authenticated encryption algorithm using AES-CBC and HMAC SHA-2 ("A128CBC-HS256" and "A256CBC-HS512") MUST be implemented by conforming implementations. It is RECOMMENDED that implementations also support using Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) to agree upon a key used to wrap the Content Encryption Key ("ECDH-ES+A128KW" and "ECDH-ES+A256KW") and AES in Galois/Counter Mode (GCM) with 128- and 256-bit keys ("A128GCM" and "A256GCM"). Support for other algorithms and key sizes is OPTIONAL.

I don't think the JWT library we use currently supports JWE but should this change, I will of course take a second look at this. Happy to discuss further if you have further comments. Thank you for getting in touch regarding this

asgeirn commented 2 years ago

This issue is related to JWS, not JWE. The RS256, RS384 and RS512 signature algorithms all require an RSA key with modulus length at least 2048 bits.

lcobucci commented 1 year ago

@asgeirn I believe this is something for the underlying library. We realised we missed the minimum key size for HMAC algorithms and as I was about to release 4.2.0 I saw this.

More info in: https://github.com/lcobucci/jwt/issues/854

lcobucci commented 1 year ago

@Sephster @alexbilbie the implementation will be similar to https://github.com/lcobucci/jwt/pull/835, so an exception will be raised when receiving short keys.

Sephster commented 1 year ago

Thanks. Will revisit this shortly. Cheers for the heads up

lcobucci commented 1 year ago

Implemented in https://github.com/lcobucci/jwt/pull/855 and going to be released in 4.2.0 :+1: