Repository navigation
Conversation
_cjose_jws_build_dig_hmac_sha() handed jwk->keydata to HMAC_Init_ex() as keysize/8 octets of key material for any key type; the key type was only checked afterwards in _cjose_jws_build_sig_hmac_sha(). For an EC or RSA key keydata is a (much smaller) key structure, so cjose_jws_sign() with an HS256/HS384/HS512 header and such a key computed an HMAC over the structure and past the end of its allocation before failing; valgrind flags the over-read. The call did return CJOSE_ERR_INVALID_ARG, so the visible behaviour does not change. Reject a non-oct key up front, as the other digest and signing steps do for their key types. The regression test signs with EC and RSA keys under the three HS algorithms; it fails on master under valgrind. Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
zandbelt
force-pushed
the
ci-openssl-3.0-okp
branch
from
September 11, 2026 10:39
9bfd8ab to
f7e28ac
Compare
zandbelt
changed the title
zandbelt
force-pushed
the
ci-openssl-3.0-okp
branch
from
September 11, 2026 10:46
f7e28ac to
fb62f5c
Compare
Add "OKP" JWKs (RFC 8037 section 2) holding a raw Ed25519 or Ed448 signature key (RFC 8032) or an X25519 or X448 key agreement key (RFC 7748): cjose_jwk_create_OKP_random, cjose_jwk_create_OKP_spec and cjose_jwk_OKP_get_curve, plus import through cjose_jwk_import and export through cjose_jwk_to_json. The public key "x" and the private key "d" must have the fixed size of the curve, when both are given "x" must be the public key that belongs to "d", and the decoded "d" is wiped after use like the other private key material. The key lives in an EVP_PKEY through the raw key API of OpenSSL 1.1.1; with an older OpenSSL the OKP functions fail with CJOSE_ERR_INVALID_ARG. Ported from the version-1.0.x branch of OpenIDC/cjose, rewritten from the OpenSSL 3 OSSL_PARAM API to the OpenSSL 1.1.1 raw key API. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
zandbelt
force-pushed
the
ci-openssl-3.0-okp
branch
from
September 11, 2026 10:55
fb62f5c to
aa9c287
Compare
Add the fully-specified EdDSA (RFC 8032) JWS algorithms "Ed25519" and "Ed448" of RFC 9864 over OKP keys. Each identifier is bound to a key of its own curve, the X25519/X448 key agreement keys are refused (RFC 8037 section 3.1), and a signature must have the fixed size of the curve (64 or 114 octets) before it is handed to OpenSSL. PureEdDSA signs the JWS signing input itself, so the digest step keeps B64U(HEADER).B64U(DATA) and signing and verification use the one-shot EVP_DigestSign and EVP_DigestVerify of OpenSSL 1.1.1. The polymorphic "EdDSA" identifier of RFC 8037, which RFC 9864 deprecates in favour of Ed25519 and Ed448, is not supported: a JWS carrying it does not import and nothing can be signed with it. Ported from the version-1.0.x branch of OpenIDC/cjose. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
The build sets OPENSSL_API_COMPAT=0x10100000L. Under that level OpenSSL 1.1.x no longer provides the pre-1.1.0 compatibility names EVP_CIPHER_CTX_init, ERR_load_crypto_strings, OpenSSL_add_all_algorithms, EVP_cleanup and ERR_free_strings, which 1.0.x implements as functions and 3.x still defines as macros, so the library and the test harness failed to compile with implicit function declarations. jws.c also relied on a transitive <openssl/bn.h> include that went away when the public headers stopped including OpenSSL headers (cisco#166); 1.0.x and 3.x happen to pull it in through <openssl/rsa.h>. Drop the EVP_CIPHER_CTX_init calls, which are redundant right after EVP_CIPHER_CTX_new on every release, include bn.h where the BIGNUM functions are used, and confine the explicit initialisation and cleanup in the test harness to OpenSSL before 1.1.0, which initialises itself. README.md promises OpenSSL 1.0.1h or newer; the OpenSSL workflow that follows builds against the last release of every series to keep it that way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
The Build and Archs workflows test against the OpenSSL that the platform packages provide, which is a recent release, so behaviour that only differs in another release goes unnoticed, and README.md promises OpenSSL 1.0.1h or newer. Add an OpenSSL workflow that builds the last release of every series from 1.0.1 to 4.0 from the GitHub release tarball (sha256 pinned, cached across runs), configures cjose with OPENSSL_ROOT_DIR pointing at it, checks with ldd that check_cjose loads that library rather than the system one, and runs the tests. 3.0.7 is in the matrix as well: it is the release RHEL 9 is based on and the last 3.0.x whose EdDSA signing dereferences a missing private key instead of failing; 3.0.8 added the guard. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
actions/cache@v4 targets Node.js 20, which GitHub has deprecated on its runners: every run carries a "Node.js 20 is deprecated ... forced to run on Node.js 24: actions/cache@v4" annotation. v5 moved the action to Node.js 24 with unchanged inputs and v6 is the current major. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
zandbelt
force-pushed
the
ci-openssl-3.0-okp
branch
from
September 11, 2026 10:58
aa9c287 to
f053c3e
Compare
Member
Author
|
Done: with the review fixes on cisco#169 all 13 matrix entries pass, including 1.1.1w and 3.0.7 that segfaulted before. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validation run inside the fork: the OpenSSL release-series matrix on top of the two commits of cisco#169. Expected: the 3.0.7 and 1.1.1w entries fail with a SEGFAULT in the jws suite (signing with a public-only Ed25519 key,
test_cjose_jws_ed25519_rejects_wrong_key; OpenSSL before 3.0.8 dereferences the missing private key), every other entry and every other job passes. Throwaway, will be closed.🤖 Generated with Claude Code