104080 custom rsapss salt length #119255

henning-krause · 2025-09-02T05:45:50Z

Added support for custom PSS salt length for RSA based signature operations. Resolves #104080.

With this PR, I have extended the RsaSignaturePadding class with a custom salt length as discussed in #104080. I've also updated the CmsSigner and the CertificateRequest class to support this.

CoseSigner did not need functionality updates, because the spec does not support custom salt length. I have added checks to prevent this to be configured on the CoseSigner.

Tests where either added or updated to test the new functionality.

All RSA implementations which support this (MAC doesn't seem to support this) were updated.

…ation/generation with RSA keys. dotnet#104080

…lt customizations

…pported there) Updated reference code

Cose does not support custom salt lengths with PSS.

dotnet-policy-service · 2025-09-02T05:47:05Z

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copilot

Pull Request Overview

This pull request adds support for custom PSS salt length for RSA-based signature operations. The implementation extends the RSASignaturePadding class with a new CreatePss(int saltLength) method and updates related cryptographic components to utilize custom salt lengths.

Key changes include:

Extended RSASignaturePadding to support custom PSS salt lengths with new constants and factory method
Updated all RSA implementation backends (OpenSSL, CNG, BCrypt, etc.) to handle custom salt lengths
Added comprehensive test coverage for various salt length scenarios
Updated high-level APIs like CmsSigner and CertificateRequest to support the new functionality

Reviewed Changes

Copilot reviewed 40 out of 41 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.h	Added pssSaltLength parameter to RSA sign/verify functions
src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c	Implemented custom salt length support in OpenSSL backend
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs	Added CreatePss method, PssSaltLength property, and related constants
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/RSAPssX509SignatureGenerator.cs	Updated to use custom salt lengths from padding configuration
src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs	Modified PSS encoding/verification to accept custom salt lengths
src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs	Added salt length calculation logic and moved digest info constants
src/libraries/System.Security.Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs	Added comprehensive tests for custom PSS salt lengths
src/libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/CmsSigner.cs	Updated validation to accept any PSS mode padding
src/libraries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSigner.cs	Added validation to prevent custom salt lengths in COSE

src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs

src/libraries/System.Security.Cryptography.Cng/tests/RSACngPkcs8TestsWithCustomPssSaltLength.cs

...rity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestChainTests.cs

…tes/CertificateCreation/CertificateRequestChainTests.cs Co-authored-by: Copilot <[email protected]>

….Cryptography.cs Co-authored-by: Copilot <[email protected]>

…/henning-krause/runtime into 104080-custom-rsapss-salt-length

src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptSignHash.cs

src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptVerifySignature.cs

vcsjones · 2025-09-03T14:31:54Z

src/libraries/Common/src/System/Security/Cryptography/Asn1/PssParamsAsn.manual.cs

@@ -41,6 +41,9 @@ internal RSASignaturePadding GetSignaturePadding(
                        HashAlgorithm.Algorithm));
            }

+#if NET10_0_OR_GREATER


This is tricky. Right now, .NET 10 is "done". Technically this work will go in for .NET 11. However, the runtime and SDK are not "bumped" to .NET 11 yet so #if NET11_0_OR_GREATER doesn't exist. We might need to wait for this work until #118583 is complete.

src/libraries/Common/src/System/Security/Cryptography/RSAAppleCrypto.cs

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs

...rity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestUsageTests.cs

bartonjs

I've made it about halfway, but have to disappear for a bit, so posting what I've already seen.

src/libraries/Common/src/System/Security/Cryptography/RSAAndroid.cs

src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

...braries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/SignVerify.cs

src/libraries/System.Security.Cryptography.Cng/tests/RSACngPkcs8TestsPssSaltLength.cs

...raries/System.Security.Cryptography.Cose/src/System/Security/Cryptography/Cose/CoseSigner.cs

src/libraries/System.Security.Cryptography.Cose/tests/CoseSignerTests.cs

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsTests.netcoreapp.cs

src/libraries/System.Security.Cryptography.Pkcs/tests/SignedCms/SignedCmsWholeDocumentTests.cs

...urity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestLoadTests.cs

...Cryptography/tests/X509Certificates/CertificateCreation/RSAPssX509SignatureGeneratorTests.cs

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs

...urity.Cryptography/tests/X509Certificates/CertificateCreation/CertificateRequestLoadTests.cs

...s/System.Security.Cryptography/tests/X509Certificates/CertificateCreation/CrlBuilderTests.cs

bartonjs · 2025-09-10T22:34:26Z

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs

        public static RSASignaturePadding CreatePss(int saltLength)
        {
            switch (saltLength)
            {
                case PssSaltLengthIsHashLength or PssSaltLengthMax:
-                case > 0:
+                case >= 0:


I see that a test that had been expecting zero to fail has been removed. But I don't see any tests showing

That 0 is allowed here

That 0 works when directly using the type

That 0 works when used with CertificateRequest

That 0 works when used with SignedCms

Please add those tests (or show me where I missed them)

Added test to RSASignaturePadding_Constructor_ValidParameters

PssRoundTripParameters already includes 0.

CreateSignature_RsaPss already includes a test for 0 (via CreateSignature_RsaPssTests)

Added a test for 0 in SelfSign_RSA_PssPadding_CustomSaltLength

bartonjs · 2025-09-10T22:44:46Z

src/libraries/Common/src/System/Security/Cryptography/RSAAppleCrypto.cs

+                // Apple does not support custom salt length for the PSS padding
+                if (padding.Mode == RSASignaturePaddingMode.Pss &&
+                    (padding.PssSaltLength != RSASignaturePadding.PssSaltLengthIsHashLength &&
+                    padding.PssSaltLength != RsaPaddingProcessor.HashLength(hashAlgorithm)))


I believe the tests for Apple say that customizing the salt size isn't supported, but this says that a specified salt size is allowed if it matches the PssSaltLengthIsHashLength calculated size.

That suggests that we're missing negative tests (e.g. we want to see the exception when calling Apple), and that we don't have a test for when it matches.

If I've just missed the tests, feel free to point them out to me.

Added a test PssUnsupportedPssSaltLengthOnApple in SignVerify

I've updated the PssRoundTripParameters to return test values with the salt length matching the hash length. This should cover the positive test.

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

src/libraries/System.Security.Cryptography/src/Resources/Strings.resx

src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.DigestInfo.cs

src/libraries/System.Security.Cryptography/src/Resources/Strings.resx

...s/System.Security.Cryptography/tests/X509Certificates/CertificateCreation/CrlBuilderTests.cs

henning-krause and others added 23 commits May 16, 2025 11:32

Added support for a custom salt length when using PSS signature valid…

e0b1dae

…ation/generation with RSA keys. dotnet#104080

Review

05ed28b

Merge branch 'dotnet:main' into 104080-custom-rsapss-salt-length

21135d5

Review all usages for RSASignaturePadding to check for missing PSS sa…

d705126

…lt customizations

Added error handling for apple devices (custom PSS salt length not su…

3c6288c

…pported there) Updated reference code

Added sign and verify tests for custom salt lengths

4d3bd37

Added test for max salt length verification

d19d017

Added a test for the RSAPssX509SignatureGenerator

20be62b

Added test for CertificateRequest.LoadSigningRequest

c0d0ce0

More tests for the CertificateRequest

81432d5

Added custom salt support for SignedCms

a016382

Add error handling for PSS salt length in CoseSigner

9cde2fa

Cose does not support custom salt lengths with PSS.

Updated RSA

a6dd48a

Merged from main

71325e3

Updated CoseSigner

e2407be

Code fixes

7b65140

Code fixes

623199c

Code fixes

b14906e

Code fixes

9dcb4ea

Code fixes

fee0f09

Code fixes

a386bac

Updated a few test cases

430a846

CRL Builder tests extended

e0eb704

Copilot AI review requested due to automatic review settings September 2, 2025 05:45

github-actions bot added the area-System.Security label Sep 2, 2025

dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label Sep 2, 2025

Copilot AI reviewed Sep 2, 2025

View reviewed changes

henning-krause and others added 2 commits September 2, 2025 07:51

Update src/libraries/System.Security.Cryptography/tests/X509Certifica…

dd64636

…tes/CertificateCreation/CertificateRequestChainTests.cs Co-authored-by: Copilot <[email protected]>

Update src/libraries/System.Security.Cryptography/ref/System.Security…

d97581c

….Cryptography.cs Co-authored-by: Copilot <[email protected]>

henning-krause added 4 commits September 3, 2025 08:07

Fixed unit tests

de11a87

Merge branch '104080-custom-rsapss-salt-length' of https://github.com…

79bb2de

…/henning-krause/runtime into 104080-custom-rsapss-salt-length

Merge branch 'main' into 104080-custom-rsapss-salt-length

6e64ad1

Fixed tests

aeab113

vcsjones reviewed Sep 3, 2025

View reviewed changes

bartonjs reviewed Sep 3, 2025

View reviewed changes

henning-krause and others added 2 commits September 5, 2025 08:47

Review changes

d70ef9b

Merge branch 'main' into 104080-custom-rsapss-salt-length

76065fe

This was referenced Sep 5, 2025

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

Android tests fail with INSTALL_FAILED_INSUFFICIENT_STORAGE #118090

Open

bartonjs reviewed Sep 5, 2025

View reviewed changes

...braries/System.Security.Cryptography/src/System/Security/Cryptography/RSASignaturePadding.cs Show resolved Hide resolved

jeffhandley added this to the 11.0.0 milestone Sep 6, 2025

jeffhandley assigned bartonjs Sep 6, 2025

henning-krause added 2 commits September 9, 2025 07:57

Fixed issues from review

28f4371

Merge branch 'main' into 104080-custom-rsapss-salt-length

a990025

henning-krause added 3 commits September 10, 2025 08:17

Fixed tests

03d9b9a

Fixed assertion

e374a19

Fixed tests

f5459a1

bartonjs reviewed Sep 11, 2025

View reviewed changes

henning-krause added 2 commits September 12, 2025 08:24

Review changes

099ac2a

Cleanup

e3fac63

build-analysis bot mentioned this pull request Sep 12, 2025

arcade/src/Microsoft.DotNet.Arcade.Sdk/src/DownloadFile.cs:line 184 TimeoutException: The operation was canceled. dotnet/dnceng#6074

Open

3 tasks

henning-krause added 2 commits September 15, 2025 08:09

Fixed apple crypto validation

d579770

Merge branch 'main' into 104080-custom-rsapss-salt-length

90beb1c

104080 custom rsapss salt length #119255

Are you sure you want to change the base?

104080 custom rsapss salt length #119255

Conversation

henning-krause commented Sep 2, 2025 • edited by jeffhandley Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service bot commented Sep 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vcsjones Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

henning-krause Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

bartonjs Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

henning-krause Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henning-krause commented Sep 2, 2025 •

edited by jeffhandley

Loading