Akira
ff03dafdb0
VerifiedPublicKeyCallback currently receives the public-key algorithm declared in the outer authentication request. For RSA authentication, that value can differ from the format of the signature that was successfully verified because compatible RSA algorithm combinations are accepted. This can cause post-verification policy or audit decisions to use the request algorithm instead of the signature format actually verified. Pass sig.Format to VerifiedPublicKeyCallback so signatureAlgorithm identifies the successfully verified signature format. Clarify the callback documentation and add a regression test covering compatible but different RSA request algorithms and signature formats. Fixes golang/go#80411 Change-Id: Ib405378d75367a90536e0814c9d26d4dec9aaa25 GitHub-Last-Rev: 1a4acd4e639361be1f2948a4aef1013436a75ecf GitHub-Pull-Request: golang/crypto#364 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/800740 Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.