From e0a54fdc4bf890e11573ddd8c531dc2cdc6eac47 Mon Sep 17 00:00:00 2001 From: Daniel Tang Date: Fri, 14 Aug 2026 13:30:58 +1000 Subject: [PATCH] acme: use crypto.SignMessage instead of calling (crypto.Signer).Sign crypto.SignMessage allows using crypto.Signers that only usefully implement SignMessage to be used for the ACME account key. This would be useful for opening up integrations with opinionated remote signing APIs that don't support pre-hashing. Fixes golang/go#80877 Change-Id: I86bb76cf5865d3d2b8606a6dbd813cbb26447c86 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/815340 Reviewed-by: Daniel McCarney Reviewed-by: Filippo Valsorda Reviewed-by: Sean Liao LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com Reviewed-by: Carlos Amedee --- acme/jws.go | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/acme/jws.go b/acme/jws.go index 6850275..2df17dd 100644 --- a/acme/jws.go +++ b/acme/jws.go @@ -103,9 +103,7 @@ func jwsEncodeJSON(claimset interface{}, key crypto.Signer, kid KeyID, nonce, ur } payload = base64.RawURLEncoding.EncodeToString(cs) } - hash := sha.New() - hash.Write([]byte(phead + "." + payload)) - sig, err := jwsSign(key, sha, hash.Sum(nil)) + sig, err := jwsSign(key, sha, []byte(phead+"."+payload)) if err != nil { return nil, err } @@ -195,14 +193,13 @@ func jwkEncode(pub crypto.PublicKey) (string, error) { return "", ErrUnsupportedKey } -// jwsSign signs the digest using the given key. -// The hash is unused for ECDSA keys. -func jwsSign(key crypto.Signer, hash crypto.Hash, digest []byte) ([]byte, error) { +// jwsSign signs the payload using the given key. +func jwsSign(key crypto.Signer, hash crypto.Hash, payload []byte) ([]byte, error) { switch pub := key.Public().(type) { case *rsa.PublicKey: - return key.Sign(rand.Reader, digest, hash) + return crypto.SignMessage(key, rand.Reader, payload, hash) case *ecdsa.PublicKey: - sigASN1, err := key.Sign(rand.Reader, digest, hash) + sigASN1, err := crypto.SignMessage(key, rand.Reader, payload, hash) if err != nil { return nil, err }