104080 custom rsapss salt length #119255

henning-krause · 2025-09-02T05:45:50Z

Added support for custom PSS salt length for RSA based signature operations. Resolves #104080.

With this PR, I have extended the RsaSignaturePadding class with a custom salt length as discussed in #104080. I've also updated the CmsSigner and the CertificateRequest class to support this.

CoseSigner did not need functionality updates, because the spec does not support custom salt length. I have added checks to prevent this to be configured on the CoseSigner.

Tests where either added or updated to test the new functionality.

All RSA implementations which support this (MAC doesn't seem to support this) were updated.

…ation/generation with RSA keys. dotnet#104080

…lt customizations

…pported there) Updated reference code

Cose does not support custom salt lengths with PSS.

dotnet-policy-service · 2025-09-02T05:47:05Z

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copilot

Pull Request Overview

This pull request adds support for custom PSS salt length for RSA-based signature operations. The implementation extends the RSASignaturePadding class with a new CreatePss(int saltLength) method and updates related cryptographic components to utilize custom salt lengths.

Key changes include:

Extended RSASignaturePadding to support custom PSS salt lengths with new constants and factory method
Updated all RSA implementation backends (OpenSSL, CNG, BCrypt, etc.) to handle custom salt lengths
Added comprehensive test coverage for various salt length scenarios
Updated high-level APIs like CmsSigner and CertificateRequest to support the new functionality

Reviewed Changes

Copilot reviewed 40 out of 41 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.h	Added pssSaltLength parameter to RSA sign/verify functions
src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c	Implemented custom salt length support in OpenSSL backend
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs	Added CreatePss method, PssSaltLength property, and related constants
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/RSAPssX509SignatureGenerator.cs	Updated to use custom salt lengths from padding configuration
src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs	Modified PSS encoding/verification to accept custom salt lengths
src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs	Added salt length calculation logic and moved digest info constants
src/libraries/System.Security.Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs	Added comprehensive tests for custom PSS salt lengths
src/libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs	Updated validation to accept any PSS mode padding
src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSigner.cs	Added validation to prevent custom salt lengths in COSE

src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs

src/libraries/System.Security.Cryptography.Cng/tests/RSACngPkcs8TestsWithCustomPssSaltLength.cs

...rity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestChainTests.cs

…tes/CertificateCreation/CertificateRequestChainTests.cs Co-authored-by: Copilot <[email protected]>

….Cryptography.cs Co-authored-by: Copilot <[email protected]>

…ngProcessor.DigestInfo.cs Co-authored-by: Copilot <[email protected]>

…s8TestsWithCustomPssSaltLength.cs Co-authored-by: Copilot <[email protected]>

…/henning-krause/runtime into 104080-custom-rsapss-salt-length

src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptSignHash.cs

src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptVerifySignature.cs

vcsjones · 2025-09-03T14:31:54Z

src/libraries/Common/src/System/Security/Cryptography/Asn1/PssParamsAsn.manual.cs

@@ -41,6 +41,9 @@ internal RSASignaturePadding GetSignaturePadding(
                        HashAlgorithm.Algorithm));
            }

+#if NET10_0_OR_GREATER


This is tricky. Right now, .NET 10 is "done". Technically this work will go in for .NET 11. However, the runtime and SDK are not "bumped" to .NET 11 yet so #if NET11_0_OR_GREATER doesn't exist. We might need to wait for this work until #118583 is complete.

src/libraries/Common/src/System/Security/Cryptography/RSAAppleCrypto.cs

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs

...rity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestUsageTests.cs

bartonjs

I've made it about halfway, but have to disappear for a bit, so posting what I've already seen.

src/libraries/Common/src/System/Security/Cryptography/RSAAndroid.cs

bartonjs · 2025-09-03T17:34:45Z

src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs

-                Debug.Assert(padding == RSASignaturePadding.Pss);
+                if (padding.PssSaltLength < RSASignaturePadding.PssSaltLengthMax)
+                {
+                    throw PaddingModeNotSupported();


The exception says the padding "mode" is invalid. Which isn't the case here. The "mode" is PSS, which is valid. So we probably want a new message for the salt size being gibberish (and yet a different one for "that doesn't work here")

@bartonjs Given that I followed the suggestion by @vcsjones and implemented validation logic on the RSASignaturePadding.CreatePss method, I think we can't run into this any more. Would it be sufficient to put in a Debug.Assert?

Yeah, an assert here is fine given the throw there.

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

...braries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/SignVerify.cs

src/libraries/System.Security.Cryptography.Cng/tests/RSACngPkcs8TestsPssSaltLength.cs

bartonjs · 2025-09-04T16:23:09Z

...raries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSigner.cs

+#if NET10_0_OR_GREATER
+            if (signaturePadding.Mode == RSASignaturePaddingMode.Pss)
+            {
+                if (signaturePadding.PssSaltLength != RSASignaturePadding.PssSaltLengthIsHashLength)


Should this also allow a custom value that happens to match?

bartonjs · 2025-09-04T16:24:36Z

src/libraries/System.Security.Cryptography.Cose/tests/CoseSignerTests.cs

+        [InlineData(0)]
+        [InlineData(17)]
+        [InlineData(RSASignaturePadding.PssSaltLengthMax)]
+        public void CoseSigner_PssPaddingWithInvalidSaltLength(int saltLength)


Whether we allow it, or not, there should be a test using 32 (matching SHA256).

bartonjs · 2025-09-04T16:37:36Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

+        [InlineData(Oids.Sha256, false, RSASignaturePadding.PssSaltLengthIsHashLength)]
+        [InlineData(Oids.Sha384, false, RSASignaturePadding.PssSaltLengthIsHashLength)]
+        [InlineData(Oids.Sha512, false, RSASignaturePadding.PssSaltLengthIsHashLength)]
+        [InlineData(Oids.Sha1, false, RSASignaturePadding.PssSaltLengthIsHashLength)]


This is a bit big for InlineData, probably should change to a MemberData using a couple of loops for enhanced legibility.

bartonjs · 2025-09-04T16:37:52Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsWholeDocumentTests.cs

@@ -127,14 +127,14 @@ public static void ReadRsaPssDocument(bool fromSpan)
            Assert.Throws<CryptographicException>(() => signer.CheckHash());

            // At this time we cannot support the PSS parameters for this document.


Comment is out of date.

bartonjs · 2025-09-04T16:38:11Z

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsWholeDocumentTests.cs

@@ -127,14 +127,14 @@ public static void ReadRsaPssDocument(bool fromSpan)
            Assert.Throws<CryptographicException>(() => signer.CheckHash());

            // At this time we cannot support the PSS parameters for this document.
-            Assert.Throws<CryptographicException>(() => signer.CheckSignature(true));
+            signer.CheckSignature(true);

            // Since there are no NoSignature signers the document CheckHash will succeed.
            // Assert.NotThrows
            cms.CheckHash();

            // Since at least one signer fails, the document signature will fail


Comment is out of date.

bartonjs · 2025-09-05T17:47:15Z

...urity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestLoadTests.cs

+        [InlineData("SHA256", 1)]
+        [InlineData("SHA384", 1)]
+        [InlineData("SHA512", 1)]
+        //[InlineData("SHA1", 1)] // The current implementation for CertificateRequest does not support SHA-1 with PSS. If this is required, the RSASha1PssSignatureGenerator and the RSAPssX509SignatureGenerator class needs updates.


SHA-1 used to be tested here. And the code doing it is still here. The coverage shouldn't be lost.

bartonjs · 2025-09-05T17:48:32Z

...urity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestLoadTests.cs

-                    deterministicSignature: false);
+                        RSASignaturePadding.CreatePss(saltLength)),
+                    X509SignatureGenerator.CreateForRSA(key, RSASignaturePadding.CreatePss(saltLength)),
+                    deterministicSignature: saltLength == 0);


So why isn't 0 included in the InlineData then?

bartonjs · 2025-09-05T17:50:29Z

...Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs

        }

+
+        [Theory]


Nit: too many blank lines

Suggested change

}

[Theory]

}

[Theory]

bartonjs · 2025-09-05T17:51:55Z

...Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs

+                var data = new byte[] { 1, 2, 3, 4, 5 };
+                var signature = signatureGenerator.SignData(data, HashAlgorithmName.SHA256);
+                var signatureAlgorithm = signatureGenerator.GetSignatureAlgorithmIdentifier(HashAlgorithmName.SHA256);
+
+                var asnReader = new AsnReader(signatureAlgorithm, AsnEncodingRules.DER);
+                var rootSequence = asnReader.ReadSequence();
+                Assert.Equal("1.2.840.113549.1.1.10", rootSequence.ReadObjectIdentifier()); // Make sure it's RSASSA-PSS
+                var pssStructure = rootSequence.ReadSequence();
+                pssStructure.ReadEncodedValue(); // Ignore the hash algorithm OID
+                pssStructure.ReadEncodedValue(); // Ignore the mask generation function OID
+                var saltTag = new Asn1Tag(TagClass.ContextSpecific, 2, true);


Many uses of var here that are against style guidelines. If you want to keep them when it's permitted, you can, but I'd just change all of them to specify the type.

bartonjs · 2025-09-05T17:52:20Z

...Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs

+                var saltTag = new Asn1Tag(TagClass.ContextSpecific, 2, true);
+                if (pssStructure.HasData && pssStructure.PeekTag().HasSameClassAndValue(saltTag))


Blank lines before control flow is preferred

Suggested change

var saltTag = new Asn1Tag(TagClass.ContextSpecific, 2, true);

if (pssStructure.HasData && pssStructure.PeekTag().HasSameClassAndValue(saltTag))

var saltTag = new Asn1Tag(TagClass.ContextSpecific, 2, true);

if (pssStructure.HasData && pssStructure.PeekTag().HasSameClassAndValue(saltTag))

bartonjs · 2025-09-05T17:54:46Z

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs

+        /// </remarks>
+        public int PssSaltLength { get; }
+
+        public static RSASignaturePadding CreatePss(int saltLength)


Public method requires documentation

henning-krause and others added 23 commits May 16, 2025 11:32

Added support for a custom salt length when using PSS signature valid…

e0b1dae

…ation/generation with RSA keys. dotnet#104080

Review

05ed28b

Merge branch 'dotnet:main' into 104080-custom-rsapss-salt-length

21135d5

Review all usages for RSASignaturePadding to check for missing PSS sa…

d705126

…lt customizations

Added error handling for apple devices (custom PSS salt length not su…

3c6288c

…pported there) Updated reference code

Added sign and verify tests for custom salt lengths

4d3bd37

Added test for max salt length verification

d19d017

Added a test for the RSAPssX509SignatureGenerator

20be62b

Added test for CertificateRequest.LoadSigningRequest

c0d0ce0

More tests for the CertificateRequest

81432d5

Added custom salt support for SignedCms

a016382

Add error handling for PSS salt length in CoseSigner

9cde2fa

Cose does not support custom salt lengths with PSS.

Updated RSA

a6dd48a

Merged from main

71325e3

Updated CoseSigner

e2407be

Code fixes

7b65140

Code fixes

623199c

Code fixes

b14906e

Code fixes

9dcb4ea

Code fixes

fee0f09

Code fixes

a386bac

Updated a few test cases

430a846

CRL Builder tests extended

e0eb704

Copilot AI review requested due to automatic review settings September 2, 2025 05:45

github-actions bot added the area-System.Security label Sep 2, 2025

dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label Sep 2, 2025

Copilot AI reviewed Sep 2, 2025

View reviewed changes

henning-krause and others added 2 commits September 2, 2025 07:51

Update src/libraries/System.Security.Cryptography/tests/X509Certifica…

dd64636

…tes/CertificateCreation/CertificateRequestChainTests.cs Co-authored-by: Copilot <[email protected]>

Update src/libraries/System.Security.Cryptography/ref/System.Security…

d97581c

….Cryptography.cs Co-authored-by: Copilot <[email protected]>

henning-krause and others added 6 commits September 2, 2025 07:52

Update src/libraries/Common/src/System/Security/Cryptography/RsaPaddi…

e99f10d

…ngProcessor.DigestInfo.cs Co-authored-by: Copilot <[email protected]>

Update src/libraries/System.Security.Cryptography.Cng/tests/RSACngPkc…

f066e97

…s8TestsWithCustomPssSaltLength.cs Co-authored-by: Copilot <[email protected]>

Fixed unit tests

de11a87

Merge branch '104080-custom-rsapss-salt-length' of https://github.com…

79bb2de

…/henning-krause/runtime into 104080-custom-rsapss-salt-length

Merge branch 'main' into 104080-custom-rsapss-salt-length

6e64ad1

Fixed tests

aeab113

vcsjones reviewed Sep 3, 2025

View reviewed changes

bartonjs reviewed Sep 3, 2025

View reviewed changes

henning-krause and others added 2 commits September 5, 2025 08:47

Review changes

d70ef9b

Merge branch 'main' into 104080-custom-rsapss-salt-length

76065fe

This was referenced Sep 5, 2025

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

Android tests fail with INSTALL_FAILED_INSUFFICIENT_STORAGE #118090

Open

bartonjs reviewed Sep 5, 2025

View reviewed changes

jeffhandley added this to the 11.0.0 milestone Sep 6, 2025

jeffhandley assigned bartonjs Sep 6, 2025

		@@ -127,14 +127,14 @@ public static void ReadRsaPssDocument(bool fromSpan)
		Assert.Throws<CryptographicException>(() => signer.CheckHash());

		// At this time we cannot support the PSS parameters for this document.

		var saltTag = new Asn1Tag(TagClass.ContextSpecific, 2, true);
		if (pssStructure.HasData && pssStructure.PeekTag().HasSameClassAndValue(saltTag))

104080 custom rsapss salt length #119255

Are you sure you want to change the base?

104080 custom rsapss salt length #119255

Uh oh!

Conversation

henning-krause commented Sep 2, 2025 • edited by jeffhandley Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service bot commented Sep 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henning-krause commented Sep 2, 2025 •

edited by jeffhandley

Loading