Reject PSS salt lengths that do not fit in a u8 - #704
Open
cong-or wants to merge 1 commit into
Open
Conversation
cong-or
force-pushed
the
fix/pss-salt-len-truncation-703
branch
from
July 28, 2026 15:30
6249132 to
99dfc07
Compare
cong-or
marked this pull request as ready for review
July 28, 2026 15:32
`get_pss_signature_algo_id` cast the salt length to `u8` with `as`, silently truncating any value >= 256 (e.g. 256 -> 0). The resulting RSASSA-PSS `AlgorithmIdentifier` then advertised the wrong salt length, so signatures produced with such a salt length failed verification. Take the salt length as `usize` in the helper and convert it with `u8::try_from`, returning a DER `Overflow` error when it does not fit, rather than encoding an incorrect value. Both `SigningKey` and `BlindedSigningKey` funnel through this helper, so both signing paths are covered. Fixes RustCrypto#703.
cong-or
force-pushed
the
fix/pss-salt-len-truncation-703
branch
from
July 28, 2026 15:34
99dfc07 to
759f236
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #703.
The problem: When signing with RSA-PSS, the signature includes metadata that records the salt length so verifiers know how to validate it. That field is encoded as a single byte, meaning it can only represent values from 0 to 255. The code previously wrote the salt length into that byte without checking whether it fit, so values of 256 or greater silently wrapped around (256 became 0, 257 became 1, and so on). As a result, the encoded salt length no longer matched the one actually used to generate the signature, causing every such signature to fail verification without any indication of why.
The fix: Validate that the configured salt length fits within a single byte before encoding it. If it exceeds 255, return a clear error instead of producing an invalid signature. Since both the standard signing key and the blinded signing key share the same encoding path, the validation applies to both automatically.
Tests: Added a regression test covering the boundary conditions by verifying that a salt length of 255 still succeeds, 256 is rejected with an error, and the blinded signing key exhibits the same behavior. I also confirmed the test fails if the previous behavior is restored, ensuring it protects against future regressions.
Fixes #703 will auto-close the issue when the PR merges. If you'd rather it not auto-close, change it to Refs #703.