Re: Re: SonarLint complaining about "Use a stronger padding scheme"
Frank Sapone <[email protected]> Mon, 15 Apr 2024 07:38:41 -0700 (PDT)
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_190116_532391641.1713191921060 Content-Type: multipart/alternative; boundary="----=_Part_190117_676314839.1713191921060" ------=_Part_190117_676314839.1713191921060 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, I've tried creating a cert as follows with openssl openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 -out=20 root.key openssl req -new -key root.key -out root.csr -config root_req.config openssl ca -in root.csr -out root.crt -config root.config -selfsign=20 -extfile ca.ext -days 7305 openssl x509 -in root.crt -outform PEM -out root.pem=20 then in my C++ code: StringSource ss(certStr, true); PEM_Load(ss, m_Cert); It will fail eventually down the path and with some debugging it appears it= =20 fails at the BERDecodeSignatureAlgorithm(tbsCertificate,=20 m_subjectSignatureAlgortihm);. More specifically at bool=20 parametersPresent =3D seq.EndReached() ? false :=20 BERDecodeAlgorithmParameters(seq); where it reaches BERDecodeAlgorithmParameters. I have not tried dumpasn as I do not have it installed, but I assume=20 sequence is different and is causing problems. Basically, I am trying to generate certificate that uses PSS with SHA256 in= =20 order to avoid SonarLint complaining about PCKS1v15 being not secure=20 enough. I am trying to make my web server generate a certificate for the= =20 user and the user inputs the cert to an app for verification that it was=20 signed by the server CA. I am new to crypto and certs so I may be doing=20 some things wrong. It seems OAEP is the right thing to use but I have no= =20 idea how to generate this or use it with cryptopp and x509certificate libs? Thanks, Frank On Monday, April 15, 2024 at 10:00:49=E2=80=AFAM UTC-4 Jeffrey Walton wrote= : > On Mon, Apr 15, 2024 at 9:18=E2=80=AFAM Frank Sapone <[email protected]= m> wrote: > >> NVM, it appears PSSR is considered more secure and this should work with= =20 >> the verifier > > > My bad, you should visit < > https://www.cryptopp.com/wiki/RSA_Signature_Schemes>. > > Jeff > > On Friday, April 12, 2024 at 12:20:56=E2=80=AFPM UTC-4 Jeffrey Walton wro= te: >> >>> On Friday, April 12, 2024 at 12:19:32=E2=80=AFPM UTC-4 franksa...@gmail= .com=20 >>> wrote: >>> >>> Hello, I am using Windows 10 Professional x64 with CryptoPP 8.9.0. It= =20 >>> is built with Visual Studio. We started using SonarQube/SonarLint for = SCA=20 >>> during compile and it's been complaining "Use a stronger padding scheme= ". =20 >>> Specifically it sees this line:=20 >>> >>> RSASS<PKCS1v15, SHA256>::Verifier verifier(publicKey); >>> >>> and complains about the PCKS1v15. I don't know how to change it to a= =20 >>> different type and what other ones are available. It suggests OAEP for= RSA=20 >>> which is what I assume we want. >>> >>> >>> https://www.cryptopp.com/wiki/RSA_Encryption_Schemes >>> >>> --=20 You received this message because you are subscribed to the Google Groups "= Crypto++ Users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/= cryptopp-users/cfcb0483-9b22-4c84-b8f4-9b92c8385337n%40googlegroups.com. ------=_Part_190117_676314839.1713191921060 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello,<br /><br />I've tried creating a cert as follows with openssl<br /><= br />openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 -out = root.key<br />openssl req -new -key root.key -out root.csr -config root_req= .config<br />openssl ca -in root.csr -out root.crt -config root.config -sel= fsign -extfile ca.ext -days 7305<br />openssl x509 -in root.crt -outform PE= M -out root.pem <br /><br />then in my C++ code:<br /><span style=3D"white-= space: pre;"> </span>StringSource ss(certStr, true);<br /><br /><span styl= e=3D"white-space: pre;"> </span>PEM_Load(ss, m_Cert);<br /><br /><br />It = will fail eventually down the path and with some debugging it appears it fa= ils at the =C2=A0 =C2=A0 =C2=A0 =C2=A0 BERDecodeSignatureAlgorithm(tbsCerti= ficate, m_subjectSignatureAlgortihm);. More specifically at =C2=A0 =C2=A0 = =C2=A0 bool parametersPresent =3D seq.EndReached() ? false : BERDecodeAlgor= ithmParameters(seq);<br />=C2=A0where it reaches BERDecodeAlgorithmParamete= rs.<br /><br />I have not tried dumpasn as I do not have it installed, but = I assume sequence is different and is causing problems.<br /><br />Basicall= y, I am trying to generate certificate that uses PSS with SHA256 in order t= o avoid SonarLint complaining about PCKS1v15 being not secure enough. =C2= =A0I am trying to make my web server generate a certificate for the user an= d the user inputs the cert to an app for verification that it was signed by= the server CA. =C2=A0I am new to crypto and certs so I may be doing some t= hings wrong. =C2=A0It seems OAEP is the right thing to use but I have no id= ea how to generate this or use it with cryptopp and x509certificate libs?<b= r /><br />Thanks,<br />Frank<br /><div class=3D"gmail_quote"><div dir=3D"au= to" class=3D"gmail_attr">On Monday, April 15, 2024 at 10:00:49=E2=80=AFAM U= TC-4 Jeffrey Walton wrote:<br/></div><blockquote class=3D"gmail_quote" styl= e=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 204, 204); paddin= g-left: 1ex;"><div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr" = class=3D"gmail_attr">On Mon, Apr 15, 2024 at 9:18=E2=80=AFAM Frank Sapone &= lt;<a href data-email-masked rel=3D"nofollow">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">NVM, it a= ppears PSSR is considered more secure and this should work with the verifie= r</blockquote><div><br></div></div></div><div dir=3D"ltr"><div class=3D"gma= il_quote"><div>My bad, you should visit <<a href=3D"https://www.cryptopp= .com/wiki/RSA_Signature_Schemes" target=3D"_blank" rel=3D"nofollow" data-sa= feredirecturl=3D"https://www.google.com/url?hl=3Den-US&q=3Dhttps://www.= cryptopp.com/wiki/RSA_Signature_Schemes&source=3Dgmail&ust=3D171327= 8287414000&usg=3DAOvVaw3tdrMuFGJwIDH4YNvhoTEo">https://www.cryptopp.com= /wiki/RSA_Signature_Schemes</a>>.</div><div><br></div><div>Jeff<br></div= ></div></div><div dir=3D"ltr"><div class=3D"gmail_quote"><div><br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex"><div></div><div class=3D"gma= il_quote"><div dir=3D"auto" class=3D"gmail_attr">On Friday, April 12, 2024 = at 12:20:56=E2=80=AFPM UTC-4 Jeffrey Walton wrote:<br></div><blockquote cla= ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div><div dir=3D"auto">On Friday, April = 12, 2024 at 12:19:32=E2=80=AFPM UTC-4 <a rel=3D"nofollow">franksa...@gmail.= com</a> wrote:<br></div><blockquote style=3D"margin:0px 0px 0px 0.8ex;borde= r-left:1px solid rgb(204,204,204);padding-left:1ex">Hello, I am using Windo= ws 10 Professional x64 with CryptoPP 8.9.0.=C2=A0 It is built with Visual S= tudio.=C2=A0 We started using SonarQube/SonarLint for SCA during compile an= d it's been complaining "Use a stronger padding scheme".=C2= =A0 Specifically it sees this line: <br><br>RSASS<PKCS1v15, SHA256>::= Verifier verifier(publicKey);<br><br>and complains about the PCKS1v15.=C2= =A0 I don't know how to change it to a different type and what other on= es are available.=C2=A0 It suggests OAEP for RSA which is what I assume we = want.<br></blockquote><div><br></div></div><div><div><a href=3D"https://www= .cryptopp.com/wiki/RSA_Encryption_Schemes" rel=3D"nofollow" target=3D"_blan= k" data-saferedirecturl=3D"https://www.google.com/url?hl=3Den-US&q=3Dht= tps://www.cryptopp.com/wiki/RSA_Encryption_Schemes&source=3Dgmail&u= st=3D1713278287414000&usg=3DAOvVaw2bclamEc2YJoKOlnLXmSw9">https://www.c= ryptopp.com/wiki/RSA_Encryption_Schemes</a></div><div><br></div> </div></blockquote></div></blockquote></div></div></blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;Crypto++ Users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">cryp= [email protected]</a>.<br /> To view this discussion on the web visit <a href=3D"https://groups.google.c= om/d/msgid/cryptopp-users/cfcb0483-9b22-4c84-b8f4-9b92c8385337n%40googlegro= ups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d= /msgid/cryptopp-users/cfcb0483-9b22-4c84-b8f4-9b92c8385337n%40googlegroups.= com</a>.<br /> ------=_Part_190117_676314839.1713191921060-- ------=_Part_190116_532391641.1713191921060--