opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-21 05:55:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

using more reliable method of validating key bit length (#58635)

Browse Source
This commit is contained in:
Erik Tate
2025-09-03 01:55:50 +00:00
committed by GitHub
parent 863ad042e3
commit 8500e8f0bc
1 changed files with 4 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/auth/keystore/pkcs11.go
+4 -17
View File
@@ -271,20 +271,6 @@ func attrValToUint(value []byte) uint64 {
return 0
}
func (p *pkcs11KeyStore) getKeyBitLen(signer crypto.Signer) (uint64, error) {
keyBitsAttr, bitsErr := p.ctx.GetAttribute(signer, crypto11.CkaModulusBits)
if bitsErr == nil {
return attrValToUint(keyBitsAttr.Value), nil
}
keyModAttr, modErr := p.ctx.GetAttribute(signer, crypto11.CkaModulus)
if modErr == nil {
return uint64(len(keyModAttr.Value) * 8), nil
}
return 0, trace.NewAggregate(bitsErr, modErr)
}
func (p *pkcs11KeyStore) validateKeyForDecryption(signer crypto.Signer) error {
keyTypeAttr, err := p.ctx.GetAttribute(signer, crypto11.CkaKeyType)
if err != nil {
@@ -295,11 +281,12 @@ func (p *pkcs11KeyStore) validateKeyForDecryption(signer crypto.Signer) error {
return trace.Errorf("invalid key algorithm, expected RSA")
}
bitLen, err := p.getKeyBitLen(signer)
modAttr, err := p.ctx.GetAttribute(signer, crypto11.CkaModulus)
if err != nil {
return trace.Wrap(err, "looking up key bit length")
return trace.Wrap(err, "looking up modulus")
}
bitLen := len(modAttr.Value) * 8
if bitLen != 4096 {
return trace.Errorf("expected 4096-bit key, found %d-bit key", bitLen)
}
@@ -320,7 +307,7 @@ func (p *pkcs11KeyStore) findDecryptersByLabel(ctx context.Context, label *types
var decrypters []crypto.Decrypter
for _, signer := range signers {
if err := p.validateKeyForDecryption(signer); err != nil {
p.log.DebugContext(ctx, "key found but could not be used for decryption", "label_type", label.Type, "label", label.Label)
p.log.DebugContext(ctx, "key found but could not be used for decryption", "label_type", label.Type, "label", label.Label, "error", err)
continue
}