add RSA key size to SignatureAlgorithm - #452
Open
jgreeer wants to merge 2 commits into
Open
Conversation
jgreeer
force-pushed
the
rsa-key-size-sig-algos
branch
from
September 9, 2026 22:03
6498b14 to
a8096fa
Compare
djc
reviewed
Sep 10, 2026
djc
left a comment
Member
There was a problem hiding this comment.
I think this makes sense with some tweaks?
Comment on lines
+42
to
+43
| // Only read under `aws_lc_rs`. Not part of identity. | ||
| #[allow(dead_code)] |
Member
There was a problem hiding this comment.
How about we just make this conditional on #[cfg(feature = "aws_lc_rs")]? Seems straightforward?
Contributor
Author
There was a problem hiding this comment.
we'd have to revert this back when we add the pluggable crypto provider right? not a big deal but it's extensible in it's current form already.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for having separate
SignatureAlgorithmvalues for different key sizes. It adds a fieldrsa_key_sizeto theSignatureAlgorithmstruct. We create a static SignatureAlgorithm struct for each combination of hash (SHA256, SHA384, SHA512) + key size (2048, 3072, 4096) adding 6 new algorithms. As a side effect, we have to passrsa_key_size: Noneto the other algorithm structs.The reason for this change is in
key_pair.rs, you can now use thegenerate_formethod to generate RSA key pairs of different key sizes by giving differentSignatureAlgorithmarguments. This removes the need forgenerate_rsa_for, so we deprecate it in the same wayRcgenErrorwas. SinceRsaKeySizeis always used now, we removed theaws-lc-rsandcryptogating.The
rsa_key_sizefield is not used it the identity of the key, because it would mess up loading the key, and we don't want to mess with the OID. At load time, like infrom_der_and_sign_algo, the user can give an RSA SigAlg value of any key size since the key size is later retrieved usingrsa_key_pair_public_modulus_len.Tests
We add a test in
lib.rsto verify that RSA algs of different key sizes are equal to each other.