mirror of
https://github.com/kubernetes/kubernetes.git
synced 2026-11-06 05:17:08 +00:00
deps: bump go-jose/go-jose for ML-DSA support
Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
This commit is contained in:
22 files changed
+503
-65
No files matched your search
@@ -28,7 +28,7 @@ require (
|
||||
github.com/docker/go-units v0.5.0
|
||||
github.com/emicklei/go-restful/v3 v3.14.0
|
||||
github.com/fsnotify/fsnotify v1.9.0
|
||||
github.com/go-jose/go-jose/v4 v4.1.7
|
||||
github.com/go-jose/go-jose/v4 v4.1.9
|
||||
github.com/go-logr/logr v1.4.4
|
||||
github.com/go-openapi/jsonreference v1.0.2
|
||||
github.com/godbus/dbus/v5 v5.2.4
|
||||
|
||||
@@ -109,8 +109,8 @@ github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01
|
||||
github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
|
||||
github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
|
||||
github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7 h1:Nac/98uT5LPkfbiFuYa8ktf62a2VxwQ4xbq1GK8pV5E=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
+1
-1
@@ -51,7 +51,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
@@ -13,7 +13,7 @@ require (
|
||||
github.com/coreos/go-systemd/v22 v22.7.0
|
||||
github.com/emicklei/go-restful/v3 v3.14.0
|
||||
github.com/fsnotify/fsnotify v1.9.0
|
||||
github.com/go-jose/go-jose/v4 v4.1.7
|
||||
github.com/go-jose/go-jose/v4 v4.1.9
|
||||
github.com/go-logr/logr v1.4.4
|
||||
github.com/go-openapi/jsonreference v1.0.2
|
||||
github.com/google/gnostic-models v0.7.1
|
||||
|
||||
Generated
+2
-2
@@ -52,8 +52,8 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7 h1:Nac/98uT5LPkfbiFuYa8ktf62a2VxwQ4xbq1GK8pV5E=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
Generated
+1
-1
@@ -47,7 +47,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
@@ -7,7 +7,7 @@ go 1.27.0
|
||||
godebug default=go1.27
|
||||
|
||||
require (
|
||||
github.com/go-jose/go-jose/v4 v4.1.7
|
||||
github.com/go-jose/go-jose/v4 v4.1.9
|
||||
github.com/stretchr/testify v1.12.1
|
||||
k8s.io/api v0.0.0
|
||||
k8s.io/apimachinery v0.0.0
|
||||
|
||||
+2
-2
@@ -2,8 +2,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7 h1:Nac/98uT5LPkfbiFuYa8ktf62a2VxwQ4xbq1GK8pV5E=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8=
|
||||
|
||||
+1
-1
@@ -44,7 +44,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
+1
-1
@@ -33,7 +33,7 @@ github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
|
||||
+1
-1
@@ -45,7 +45,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
+1
-1
@@ -44,7 +44,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
+1
-1
@@ -44,7 +44,7 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
|
||||
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
|
||||
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
|
||||
+19
-13
@@ -61,16 +61,19 @@ standard where possible. The Godoc reference has a list of constants.
|
||||
|
||||
<sup>1. Not supported in multi-recipient mode</sup>
|
||||
|
||||
| Signing / MAC | Algorithm identifier(s) |
|
||||
|:------------------|:------------------------|
|
||||
| RSASSA-PKCS#1v1.5 | RS256, RS384, RS512 |
|
||||
| RSASSA-PSS | PS256, PS384, PS512 |
|
||||
| HMAC | HS256, HS384, HS512 |
|
||||
| ECDSA | ES256, ES384, ES512 |
|
||||
| Ed25519 | EdDSA<sup>2</sup> |
|
||||
| Signing / MAC | Algorithm identifier(s) |
|
||||
|:------------------|:--------------------------------------------|
|
||||
| RSASSA-PKCS#1v1.5 | RS256, RS384, RS512 |
|
||||
| RSASSA-PSS | PS256, PS384, PS512 |
|
||||
| HMAC | HS256, HS384, HS512 |
|
||||
| ECDSA | ES256, ES384, ES512 |
|
||||
| Ed25519 | EdDSA<sup>2</sup> |
|
||||
| ML-DSA | ML-DSA-44, ML-DSA-65, ML-DSA-87<sup>3</sup> |
|
||||
|
||||
<sup>2. Only available in version 2 of the package</sup>
|
||||
|
||||
<sup>3. Requires Go 1.27 or later</sup>
|
||||
|
||||
| Content encryption | Algorithm identifier(s) |
|
||||
|:-------------------|:--------------------------------------------|
|
||||
| AES-CBC+HMAC | A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 |
|
||||
@@ -87,15 +90,18 @@ library, and can be passed to corresponding functions such as `NewEncrypter` or
|
||||
`NewSigner`. Each of these keys can also be wrapped in a JWK if desired, which
|
||||
allows attaching a key id.
|
||||
|
||||
| Algorithm(s) | Corresponding types |
|
||||
|:------------------|--------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| RSA | *[rsa.PublicKey](https://pkg.go.dev/crypto/rsa/#PublicKey), *[rsa.PrivateKey](https://pkg.go.dev/crypto/rsa/#PrivateKey) |
|
||||
| ECDH, ECDSA | *[ecdsa.PublicKey](https://pkg.go.dev/crypto/ecdsa/#PublicKey), *[ecdsa.PrivateKey](https://pkg.go.dev/crypto/ecdsa/#PrivateKey) |
|
||||
| EdDSA<sup>1</sup> | [ed25519.PublicKey](https://pkg.go.dev/crypto/ed25519#PublicKey), [ed25519.PrivateKey](https://pkg.go.dev/crypto/ed25519#PrivateKey) |
|
||||
| AES, HMAC | []byte |
|
||||
| Algorithm(s) | Corresponding types |
|
||||
|:-------------------|--------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| RSA | *[rsa.PublicKey](https://pkg.go.dev/crypto/rsa/#PublicKey), *[rsa.PrivateKey](https://pkg.go.dev/crypto/rsa/#PrivateKey) |
|
||||
| ECDH, ECDSA | *[ecdsa.PublicKey](https://pkg.go.dev/crypto/ecdsa/#PublicKey), *[ecdsa.PrivateKey](https://pkg.go.dev/crypto/ecdsa/#PrivateKey) |
|
||||
| EdDSA<sup>1</sup> | [ed25519.PublicKey](https://pkg.go.dev/crypto/ed25519#PublicKey), [ed25519.PrivateKey](https://pkg.go.dev/crypto/ed25519#PrivateKey) |
|
||||
| ML-DSA<sup>2</sup> | *[mldsa.PublicKey](https://pkg.go.dev/crypto/mldsa#PublicKey), *[mldsa.PrivateKey](https://pkg.go.dev/crypto/mldsa#PrivateKey) |
|
||||
| AES, HMAC | []byte |
|
||||
|
||||
<sup>1. Only available in version 2 or later of the package</sup>
|
||||
|
||||
<sup>2. Requires Go 1.27 or later</sup>
|
||||
|
||||
## Examples
|
||||
|
||||
[](https://pkg.go.dev/github.com/go-jose/go-jose/v4)
|
||||
|
||||
+5
@@ -21,5 +21,10 @@ the JSON Web Encryption and JSON Web Signature standards, with optional JSON Web
|
||||
Token support available in a sub-package. The library supports both the compact
|
||||
and JWS/JWE JSON Serialization formats, and has optional support for multiple
|
||||
recipients.
|
||||
|
||||
ML-DSA (FIPS 204) signing and verification, and the AKP JSON Web Key type, are
|
||||
defined by RFC 9964 and require Go 1.27 or later. On earlier toolchains the
|
||||
ML-DSA algorithms are recognized but unusable, and AKP keys fail to parse with
|
||||
ErrUnsupportedKeyType.
|
||||
*/
|
||||
package jose
|
||||
+46
-11
@@ -51,6 +51,11 @@ type rawJSONWebKey struct {
|
||||
Y *byteBuffer `json:"y,omitempty"`
|
||||
N *byteBuffer `json:"n,omitempty"`
|
||||
E *byteBuffer `json:"e,omitempty"`
|
||||
// AKP (RFC 9964). "pub" is the encoded public key; "priv" is the 32-byte
|
||||
// seed. An AKP key has no "crv" / "alg" identifies the parameter set, and is
|
||||
// REQUIRED.
|
||||
Pub *byteBuffer `json:"pub,omitempty"`
|
||||
Priv *byteBuffer `json:"priv,omitempty"`
|
||||
// -- Following fields are only used for private keys --
|
||||
// RSA uses D, P and Q, while ECDSA uses only D. Fields Dp, Dq, and Qi are
|
||||
// completely optional. Therefore for RSA/ECDSA, D != nil is a contract that
|
||||
@@ -122,7 +127,11 @@ func (k JSONWebKey) MarshalJSON() ([]byte, error) {
|
||||
case []byte:
|
||||
raw, err = fromSymmetricKey(key)
|
||||
default:
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unknown key type '%s'", reflect.TypeOf(key))
|
||||
var ok bool
|
||||
raw, ok, err = mldsaRawJWK(k.Key)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unknown key type '%s'", reflect.TypeOf(key))
|
||||
}
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
@@ -130,9 +139,19 @@ func (k JSONWebKey) MarshalJSON() ([]byte, error) {
|
||||
}
|
||||
|
||||
raw.Kid = k.KeyID
|
||||
raw.Alg = k.Algorithm
|
||||
raw.Use = k.Use
|
||||
|
||||
if raw.Kty == "AKP" {
|
||||
// RFC 9964 requires "alg" on every AKP key, and mldsaRawJWK already
|
||||
// derived it from the key's parameter set. Rather than let a caller's
|
||||
// Algorithm silently overwrite it, treat a disagreement as an error.
|
||||
if k.Algorithm != "" && k.Algorithm != raw.Alg {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: JWK algorithm %q does not match ML-DSA key parameter set %q", k.Algorithm, raw.Alg)
|
||||
}
|
||||
} else {
|
||||
raw.Alg = k.Algorithm
|
||||
}
|
||||
|
||||
for _, cert := range k.Certificates {
|
||||
raw.X5c = append(raw.X5c, base64.StdEncoding.EncodeToString(cert.Raw))
|
||||
}
|
||||
@@ -177,7 +196,7 @@ func (k JSONWebKey) MarshalJSON() ([]byte, error) {
|
||||
|
||||
// UnmarshalJSON reads a key from its JSON representation.
|
||||
//
|
||||
// Returns ErrUnsupportedKeyType for unrecognized or unsupported "kty" header values.
|
||||
// Returns ErrUnsupportedKeyType for unsupported key types or parameters.
|
||||
//
|
||||
// Directly unmarshaling a JWK is not safe for untrusted input.
|
||||
func (k *JSONWebKey) UnmarshalJSON(data []byte) error {
|
||||
@@ -197,7 +216,7 @@ func (k *JSONWebKey) unmarshalJSON(data []byte, allowPrivate bool) (err error) {
|
||||
|
||||
if !allowPrivate &&
|
||||
(raw.K != nil || raw.D != nil || raw.P != nil || raw.Q != nil ||
|
||||
raw.Dp != nil || raw.Dq != nil || raw.Qi != nil) {
|
||||
raw.Dp != nil || raw.Dq != nil || raw.Qi != nil || raw.Priv != nil) {
|
||||
return errors.New("go-jose/go-jose: JWK contains private parameters")
|
||||
}
|
||||
|
||||
@@ -273,6 +292,14 @@ func (k *JSONWebKey) unmarshalJSON(data []byte, allowPrivate bool) (err error) {
|
||||
keyPub = key
|
||||
}
|
||||
}
|
||||
case "AKP":
|
||||
key, err = mldsaParseJWK(&raw, certPub)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// mldsaParseJWK compared certPub using (*mldsa.PublicKey).Equal, so the
|
||||
// generic comparison below only needs to confirm that a leaf key exists.
|
||||
keyPub = certPub
|
||||
case "":
|
||||
// kty MUST be present
|
||||
return fmt.Errorf("go-jose/go-jose: missing json web key type")
|
||||
@@ -446,7 +473,11 @@ func (k *JSONWebKey) Thumbprint(hash crypto.Hash) ([]byte, error) {
|
||||
case OpaqueSigner:
|
||||
return key.Public().Thumbprint(hash)
|
||||
default:
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unknown key type '%s'", reflect.TypeOf(key))
|
||||
var ok bool
|
||||
input, ok, err = mldsaThumbprintInput(k.Key)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unknown key type '%s'", reflect.TypeOf(key))
|
||||
}
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
@@ -464,7 +495,7 @@ func (k *JSONWebKey) IsPublic() bool {
|
||||
case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
return mldsaIsPublic(k.Key)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -482,7 +513,11 @@ func (k *JSONWebKey) Public() JSONWebKey {
|
||||
case ed25519.PrivateKey:
|
||||
ret.Key = key.Public()
|
||||
default:
|
||||
return JSONWebKey{} // returning invalid key
|
||||
pub, ok := mldsaPublicOf(k.Key)
|
||||
if !ok {
|
||||
return JSONWebKey{} // returning invalid key
|
||||
}
|
||||
ret.Key = pub
|
||||
}
|
||||
return ret
|
||||
}
|
||||
@@ -518,7 +553,7 @@ func (k *JSONWebKey) Valid() bool {
|
||||
return false
|
||||
}
|
||||
default:
|
||||
return false
|
||||
return mldsaValid(k.Key)
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -542,7 +577,7 @@ func rsaPublicKey(N, E *byteBuffer) (*rsa.PublicKey, error) {
|
||||
|
||||
n := N.bigInt()
|
||||
if n.BitLen() > MaxRSAModulusBits {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: invalid RSA key, modulus too large")
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
e := new(big.Int).SetBytes(E.bytes())
|
||||
@@ -591,7 +626,7 @@ func (key rawJSONWebKey) ecPublicKey() (*ecdsa.PublicKey, error) {
|
||||
case "P-521":
|
||||
curve = elliptic.P521()
|
||||
default:
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unsupported elliptic curve '%s'", key.Crv)
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
if key.X == nil || key.Y == nil {
|
||||
@@ -798,7 +833,7 @@ func (key rawJSONWebKey) ecPrivateKey() (*ecdsa.PrivateKey, error) {
|
||||
case "P-521":
|
||||
curve = elliptic.P521()
|
||||
default:
|
||||
return nil, fmt.Errorf("go-jose/go-jose: unsupported elliptic curve '%s'", key.Crv)
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
var missing []string
|
||||
|
||||
+318
@@ -0,0 +1,318 @@
|
||||
//go:build go1.27
|
||||
|
||||
/*-
|
||||
* Copyright 2026 The Go JOSE Authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package jose
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/mldsa"
|
||||
"errors"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
// mldsaParamsFor maps a JOSE signature algorithm to its ML-DSA parameter set.
|
||||
//
|
||||
// See RFC 9964, which registers ML-DSA-44, ML-DSA-65 and ML-DSA-87 as JWS "alg"
|
||||
// values for the FIPS 204 parameter sets of the same names.
|
||||
func mldsaParamsFor(alg SignatureAlgorithm) (mldsa.Parameters, bool) {
|
||||
switch alg {
|
||||
case MLDSA44:
|
||||
return mldsa.MLDSA44(), true
|
||||
case MLDSA65:
|
||||
return mldsa.MLDSA65(), true
|
||||
case MLDSA87:
|
||||
return mldsa.MLDSA87(), true
|
||||
default:
|
||||
return mldsa.Parameters{}, false
|
||||
}
|
||||
}
|
||||
|
||||
// mldsaAlgFor maps an ML-DSA parameter set to its JOSE signature algorithm. An
|
||||
// AKP JWK carries no "crv", so the parameter set is the only thing that
|
||||
// identifies which algorithm a key belongs to.
|
||||
func mldsaAlgFor(params mldsa.Parameters) (SignatureAlgorithm, bool) {
|
||||
switch params {
|
||||
case mldsa.MLDSA44():
|
||||
return MLDSA44, true
|
||||
case mldsa.MLDSA65():
|
||||
return MLDSA65, true
|
||||
case mldsa.MLDSA87():
|
||||
return MLDSA87, true
|
||||
default:
|
||||
return "", false
|
||||
}
|
||||
}
|
||||
|
||||
// mldsaIsPublic reports whether key is an ML-DSA public key.
|
||||
func mldsaIsPublic(key interface{}) bool {
|
||||
_, ok := key.(*mldsa.PublicKey)
|
||||
return ok
|
||||
}
|
||||
|
||||
// mldsaValid reports whether key is an initialized ML-DSA key. It backs
|
||||
// JSONWebKey.Valid, which is how a caller asks this question. mldsaVerifier
|
||||
// rejects a nil or zero-value key and mldsaSigner rejects a nil key. The other
|
||||
// hooks treat an uninitialized key as a programmer error, and crypto/mldsa
|
||||
// panics on one.
|
||||
func mldsaValid(key interface{}) bool {
|
||||
switch k := key.(type) {
|
||||
case *mldsa.PublicKey:
|
||||
return k != nil && *k != (mldsa.PublicKey{})
|
||||
case *mldsa.PrivateKey:
|
||||
return k != nil && *k != (mldsa.PrivateKey{})
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// mldsaPublicOf returns the public half of an ML-DSA private key.
|
||||
func mldsaPublicOf(key interface{}) (interface{}, bool) {
|
||||
if k, ok := key.(*mldsa.PrivateKey); ok {
|
||||
return k.PublicKey(), true
|
||||
}
|
||||
return nil, false
|
||||
}
|
||||
|
||||
// mldsaPrivateKeySigner signs payloads with an ML-DSA private key. The algorithm
|
||||
// is resolved from the key's parameter set once at construction and cached.
|
||||
type mldsaPrivateKeySigner struct {
|
||||
privateKey *mldsa.PrivateKey
|
||||
alg SignatureAlgorithm
|
||||
}
|
||||
|
||||
// mldsaPublicKeyVerifier verifies payloads with an ML-DSA public key.
|
||||
type mldsaPublicKeyVerifier struct {
|
||||
publicKey *mldsa.PublicKey
|
||||
alg SignatureAlgorithm
|
||||
}
|
||||
|
||||
// mldsaSigner creates a recipientSigInfo for an ML-DSA private key. The second
|
||||
// return value reports whether key was an ML-DSA key at all.
|
||||
func mldsaSigner(sigAlg SignatureAlgorithm, key interface{}) (recipientSigInfo, bool, error) {
|
||||
privateKey, ok := key.(*mldsa.PrivateKey)
|
||||
if !ok {
|
||||
return recipientSigInfo{}, false, nil
|
||||
}
|
||||
if privateKey == nil {
|
||||
return recipientSigInfo{}, true, errors.New("invalid private key")
|
||||
}
|
||||
|
||||
alg, ok := mldsaAlgFor(privateKey.PublicKey().Parameters())
|
||||
if !ok || alg != sigAlg {
|
||||
return recipientSigInfo{}, true, ErrUnsupportedAlgorithm
|
||||
}
|
||||
|
||||
return recipientSigInfo{
|
||||
sigAlg: sigAlg,
|
||||
publicKey: staticPublicKey(&JSONWebKey{
|
||||
Key: privateKey.PublicKey(),
|
||||
}),
|
||||
signer: &mldsaPrivateKeySigner{
|
||||
privateKey: privateKey,
|
||||
alg: alg,
|
||||
},
|
||||
}, true, nil
|
||||
}
|
||||
|
||||
// mldsaVerifier creates a payloadVerifier for an ML-DSA public key.
|
||||
func mldsaVerifier(key interface{}) (payloadVerifier, bool, error) {
|
||||
publicKey, ok := key.(*mldsa.PublicKey)
|
||||
if !ok {
|
||||
return nil, false, nil
|
||||
}
|
||||
if publicKey == nil || *publicKey == (mldsa.PublicKey{}) {
|
||||
return nil, true, errInvalidVerificationKey
|
||||
}
|
||||
|
||||
alg, ok := mldsaAlgFor(publicKey.Parameters())
|
||||
if !ok {
|
||||
return nil, true, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
return &mldsaPublicKeyVerifier{
|
||||
publicKey: publicKey,
|
||||
alg: alg,
|
||||
}, true, nil
|
||||
}
|
||||
|
||||
// mldsaRawJWK converts an ML-DSA key to its AKP JWK representation. The "alg"
|
||||
// member is derived from the key's own parameter set, because RFC 9964 requires
|
||||
// it on every AKP key and it is the only member identifying the parameter set.
|
||||
func mldsaRawJWK(key interface{}) (*rawJSONWebKey, bool, error) {
|
||||
var (
|
||||
pub *mldsa.PublicKey
|
||||
priv *mldsa.PrivateKey
|
||||
)
|
||||
|
||||
switch k := key.(type) {
|
||||
case *mldsa.PublicKey:
|
||||
pub = k
|
||||
case *mldsa.PrivateKey:
|
||||
priv, pub = k, k.PublicKey()
|
||||
default:
|
||||
return nil, false, nil
|
||||
}
|
||||
|
||||
alg, ok := mldsaAlgFor(pub.Parameters())
|
||||
if !ok {
|
||||
return nil, true, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
raw := &rawJSONWebKey{
|
||||
Kty: "AKP",
|
||||
Alg: string(alg),
|
||||
Pub: newBuffer(pub.Bytes()),
|
||||
}
|
||||
if priv != nil {
|
||||
// RFC 9964: priv MUST be the seed, and MUST be 32 bytes. Bytes() returns
|
||||
// exactly that.
|
||||
raw.Priv = newBuffer(priv.Bytes())
|
||||
}
|
||||
|
||||
return raw, true, nil
|
||||
}
|
||||
|
||||
// mldsaParseJWK builds an ML-DSA key from an AKP JWK.
|
||||
//
|
||||
// RFC 9964 makes "alg" REQUIRED for AKP keys: unlike EC and OKP there is no
|
||||
// "crv", so "alg" is the only member identifying the parameter set. A JWK
|
||||
// without a recognized "alg" is therefore not merely unusual but unusable, and
|
||||
// is rejected with ErrUnsupportedKeyType.
|
||||
//
|
||||
// A parsed key can never carry an alg/material disagreement: params is derived
|
||||
// from raw.Alg below, and mldsa.NewPrivateKey/NewPublicKey both reject key
|
||||
// material whose length disagrees with those params.
|
||||
//
|
||||
// When certPub is non-nil it is checked against the key's public half here,
|
||||
// using (*mldsa.PublicKey).Equal, so that the caller does not have to compare
|
||||
// unexported crypto/mldsa internals with reflect.DeepEqual.
|
||||
func mldsaParseJWK(raw *rawJSONWebKey, certPub interface{}) (interface{}, error) {
|
||||
params, ok := mldsaParamsFor(SignatureAlgorithm(raw.Alg))
|
||||
if !ok {
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
// RFC 9964 makes "pub" REQUIRED on every AKP JWK.
|
||||
if raw.Pub == nil {
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
var (
|
||||
key interface{}
|
||||
pub *mldsa.PublicKey
|
||||
)
|
||||
|
||||
if raw.Priv != nil {
|
||||
// RFC 9964: priv MUST be the seed, and MUST be 32 bytes. NewPrivateKey
|
||||
// enforces the length.
|
||||
privateKey, err := mldsa.NewPrivateKey(params, raw.Priv.bytes())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: invalid ML-DSA private key: %w", err)
|
||||
}
|
||||
pub = privateKey.PublicKey()
|
||||
if !bytes.Equal(raw.Pub.bytes(), pub.Bytes()) {
|
||||
return nil, errors.New("go-jose/go-jose: invalid ML-DSA key, pub does not match the public key derived from priv")
|
||||
}
|
||||
key = privateKey
|
||||
} else {
|
||||
// NewPublicKey rejects an encoding whose length disagrees with params,
|
||||
// which is what catches an alg/pub mismatch.
|
||||
publicKey, err := mldsa.NewPublicKey(params, raw.Pub.bytes())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("go-jose/go-jose: invalid ML-DSA public key: %w", err)
|
||||
}
|
||||
pub = publicKey
|
||||
key = publicKey
|
||||
}
|
||||
|
||||
if certPub != nil && !pub.Equal(certPub) {
|
||||
return nil, errors.New("go-jose/go-jose: invalid JWK, public keys in key and x5c fields do not match")
|
||||
}
|
||||
|
||||
return key, nil
|
||||
}
|
||||
|
||||
func (ctx mldsaPrivateKeySigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
|
||||
if alg != ctx.alg {
|
||||
return Signature{}, ErrUnsupportedAlgorithm
|
||||
}
|
||||
|
||||
// RFC 9964 specifies empty context string and doesn't specify pre-hashing.
|
||||
// Passing a `nil` crypto.SignerOpts gets us that.
|
||||
sig, err := ctx.privateKey.Sign(nil, payload, nil)
|
||||
if err != nil {
|
||||
return Signature{}, err
|
||||
}
|
||||
|
||||
return Signature{
|
||||
Signature: sig,
|
||||
protected: &rawHeader{},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (ctx mldsaPublicKeyVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
|
||||
// Reject a header algorithm that disagrees with the key's parameter set, so
|
||||
// an ML-DSA-44 key can never be used under an ML-DSA-87 header.
|
||||
if alg != ctx.alg {
|
||||
return ErrUnsupportedAlgorithm
|
||||
}
|
||||
|
||||
// A nil Options means an empty context string, matching RFC 9964.
|
||||
if err := mldsa.Verify(ctx.publicKey, payload, signature, nil); err != nil {
|
||||
return fmt.Errorf("go-jose/go-jose: %s signature failed to verify: %w", ctx.alg, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// mldsaThumbprintTemplate is the JWK Thumbprint input for AKP keys. RFC 9964
|
||||
// gives the required members as "alg", "kty" and "pub"; RFC 7638 requires them
|
||||
// in lexicographic order with no whitespace. Note that AKP is the only key type
|
||||
// in this package whose thumbprint includes "alg". The verbs take the algorithm
|
||||
// name and the unpadded base64url encoding of the public key's FIPS 204 encoding.
|
||||
const mldsaThumbprintTemplate = `{"alg":"%s","kty":"AKP","pub":"%s"}`
|
||||
|
||||
// mldsaThumbprintInput builds the JWK Thumbprint input for an ML-DSA key. A
|
||||
// private key thumbprints as its public half.
|
||||
//
|
||||
// key is the value of JSONWebKey.Key and may be of any type; only
|
||||
// *mldsa.PublicKey and *mldsa.PrivateKey are ML-DSA keys.
|
||||
//
|
||||
// The second return value reports whether key was an ML-DSA key at all. When it
|
||||
// is false the string is empty and the error is nil, leaving the caller to
|
||||
// report the unknown key type. When it is true the error is non-nil if the key's
|
||||
// parameter set has no JOSE algorithm.
|
||||
func mldsaThumbprintInput(key interface{}) (string, bool, error) {
|
||||
var pub *mldsa.PublicKey
|
||||
|
||||
switch k := key.(type) {
|
||||
case *mldsa.PublicKey:
|
||||
pub = k
|
||||
case *mldsa.PrivateKey:
|
||||
pub = k.PublicKey()
|
||||
default:
|
||||
return "", false, nil
|
||||
}
|
||||
|
||||
alg, ok := mldsaAlgFor(pub.Parameters())
|
||||
if !ok {
|
||||
return "", true, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
return fmt.Sprintf(mldsaThumbprintTemplate, alg, newBuffer(pub.Bytes()).base64()), true, nil
|
||||
}
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
//go:build !go1.27
|
||||
|
||||
/*-
|
||||
* Copyright 2026 The Go JOSE Authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
// This file provides the ML-DSA seam for toolchains without crypto/mldsa, which
|
||||
// was added in Go 1.27. Every hook reports that it did not recognize the key, so
|
||||
// callers fall through to their existing unsupported-key/algorithm error.
|
||||
//
|
||||
// Each identifier here must have a counterpart in mldsa.go.
|
||||
|
||||
package jose
|
||||
|
||||
func mldsaIsPublic(_ interface{}) bool { return false }
|
||||
|
||||
func mldsaValid(_ interface{}) bool { return false }
|
||||
|
||||
func mldsaPublicOf(_ interface{}) (interface{}, bool) { return nil, false }
|
||||
|
||||
func mldsaSigner(_ SignatureAlgorithm, _ interface{}) (recipientSigInfo, bool, error) {
|
||||
return recipientSigInfo{}, false, nil
|
||||
}
|
||||
|
||||
func mldsaVerifier(_ interface{}) (payloadVerifier, bool, error) { return nil, false, nil }
|
||||
|
||||
func mldsaRawJWK(_ interface{}) (*rawJSONWebKey, bool, error) { return nil, false, nil }
|
||||
|
||||
func mldsaParseJWK(_ *rawJSONWebKey, _ interface{}) (interface{}, error) {
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
|
||||
func mldsaThumbprintInput(_ interface{}) (string, bool, error) { return "", false, nil }
|
||||
+20
-2
@@ -16,6 +16,12 @@
|
||||
|
||||
package jose
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/ed25519"
|
||||
"crypto/rsa"
|
||||
)
|
||||
|
||||
// OpaqueSigner is an interface that supports signing payloads with opaque
|
||||
// private key(s). Private key operations performed by implementers may, for
|
||||
// example, occur in a hardware module. An OpaqueSigner may rotate signing keys
|
||||
@@ -46,8 +52,7 @@ func newOpaqueSigner(alg SignatureAlgorithm, signer OpaqueSigner) (recipientSigI
|
||||
return recipientSigInfo{}, ErrUnsupportedAlgorithm
|
||||
}
|
||||
|
||||
pk := signer.Public()
|
||||
if pk != nil && !pk.IsPublic() {
|
||||
if pk := signer.Public(); pk != nil && isKnownPrivateKeyType(pk.Key) {
|
||||
return recipientSigInfo{}, ErrNotPublic
|
||||
}
|
||||
|
||||
@@ -60,6 +65,19 @@ func newOpaqueSigner(alg SignatureAlgorithm, signer OpaqueSigner) (recipientSigI
|
||||
}, nil
|
||||
}
|
||||
|
||||
// isKnownPrivateKeyType reports whether key is a private key of one of the
|
||||
// supported signing algorithms. Other key types are allowed, since an
|
||||
// OpaqueSigner may use a key type that go-jose does not know about.
|
||||
func isKnownPrivateKeyType(key any) bool {
|
||||
switch key.(type) {
|
||||
case *ecdsa.PrivateKey, *rsa.PrivateKey, ed25519.PrivateKey:
|
||||
return true
|
||||
default:
|
||||
_, ok := mldsaPublicOf(key)
|
||||
return ok
|
||||
}
|
||||
}
|
||||
|
||||
func (o *opaqueSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
|
||||
out, err := o.signer.SignPayload(payload, alg)
|
||||
if err != nil {
|
||||
|
||||
+19
-22
@@ -53,11 +53,8 @@ var (
|
||||
// algorithm that is not yet implemented.
|
||||
ErrUnsupportedAlgorithm = errors.New("go-jose/go-jose: unknown/unsupported algorithm")
|
||||
|
||||
// ErrUnsupportedKeyType indicates that the given key type/format is not
|
||||
// supported. This occurs when trying to instantiate an encrypter and passing
|
||||
// it a key of an unrecognized type or with unsupported parameters, such as
|
||||
// an RSA private key with more than two primes.
|
||||
ErrUnsupportedKeyType = errors.New("go-jose/go-jose: unsupported key type/format")
|
||||
// ErrUnsupportedKeyType indicates that the given key is not supported.
|
||||
ErrUnsupportedKeyType = errors.New("go-jose/go-jose: unsupported key type, format, curve, or RSA modulus size")
|
||||
|
||||
// ErrInvalidKeySize indicates that the given key is not the correct size
|
||||
// for the selected algorithm. This can occur, for example, when trying to
|
||||
@@ -76,9 +73,6 @@ var (
|
||||
// ErrMissingX5cHeader indicates that the JWT header is missing x5c headers.
|
||||
ErrMissingX5cHeader = errors.New("go-jose/go-jose: no x5c header present in message")
|
||||
|
||||
// ErrUnsupportedEllipticCurve indicates unsupported or unknown elliptic curve has been found.
|
||||
ErrUnsupportedEllipticCurve = errors.New("go-jose/go-jose: unsupported/unknown elliptic curve")
|
||||
|
||||
// ErrUnsupportedCriticalHeader is returned when a header is marked critical but not supported by go-jose.
|
||||
ErrUnsupportedCriticalHeader = errors.New("go-jose/go-jose: unsupported critical header")
|
||||
|
||||
@@ -113,19 +107,22 @@ const (
|
||||
|
||||
// Signature algorithms
|
||||
const (
|
||||
EdDSA = SignatureAlgorithm("EdDSA")
|
||||
HS256 = SignatureAlgorithm("HS256") // HMAC using SHA-256
|
||||
HS384 = SignatureAlgorithm("HS384") // HMAC using SHA-384
|
||||
HS512 = SignatureAlgorithm("HS512") // HMAC using SHA-512
|
||||
RS256 = SignatureAlgorithm("RS256") // RSASSA-PKCS-v1.5 using SHA-256
|
||||
RS384 = SignatureAlgorithm("RS384") // RSASSA-PKCS-v1.5 using SHA-384
|
||||
RS512 = SignatureAlgorithm("RS512") // RSASSA-PKCS-v1.5 using SHA-512
|
||||
ES256 = SignatureAlgorithm("ES256") // ECDSA using P-256 and SHA-256
|
||||
ES384 = SignatureAlgorithm("ES384") // ECDSA using P-384 and SHA-384
|
||||
ES512 = SignatureAlgorithm("ES512") // ECDSA using P-521 and SHA-512
|
||||
PS256 = SignatureAlgorithm("PS256") // RSASSA-PSS using SHA256 and MGF1-SHA256
|
||||
PS384 = SignatureAlgorithm("PS384") // RSASSA-PSS using SHA384 and MGF1-SHA384
|
||||
PS512 = SignatureAlgorithm("PS512") // RSASSA-PSS using SHA512 and MGF1-SHA512
|
||||
EdDSA = SignatureAlgorithm("EdDSA")
|
||||
HS256 = SignatureAlgorithm("HS256") // HMAC using SHA-256
|
||||
HS384 = SignatureAlgorithm("HS384") // HMAC using SHA-384
|
||||
HS512 = SignatureAlgorithm("HS512") // HMAC using SHA-512
|
||||
RS256 = SignatureAlgorithm("RS256") // RSASSA-PKCS-v1.5 using SHA-256
|
||||
RS384 = SignatureAlgorithm("RS384") // RSASSA-PKCS-v1.5 using SHA-384
|
||||
RS512 = SignatureAlgorithm("RS512") // RSASSA-PKCS-v1.5 using SHA-512
|
||||
ES256 = SignatureAlgorithm("ES256") // ECDSA using P-256 and SHA-256
|
||||
ES384 = SignatureAlgorithm("ES384") // ECDSA using P-384 and SHA-384
|
||||
ES512 = SignatureAlgorithm("ES512") // ECDSA using P-521 and SHA-512
|
||||
PS256 = SignatureAlgorithm("PS256") // RSASSA-PSS using SHA256 and MGF1-SHA256
|
||||
PS384 = SignatureAlgorithm("PS384") // RSASSA-PSS using SHA384 and MGF1-SHA384
|
||||
PS512 = SignatureAlgorithm("PS512") // RSASSA-PSS using SHA512 and MGF1-SHA512
|
||||
MLDSA44 = SignatureAlgorithm("ML-DSA-44") // ML-DSA-44 (FIPS 204, RFC 9964), requires Go 1.27 or later
|
||||
MLDSA65 = SignatureAlgorithm("ML-DSA-65") // ML-DSA-65 (FIPS 204, RFC 9964), requires Go 1.27 or later
|
||||
MLDSA87 = SignatureAlgorithm("ML-DSA-87") // ML-DSA-87 (FIPS 204, RFC 9964), requires Go 1.27 or later
|
||||
)
|
||||
|
||||
// Content encryption algorithms
|
||||
@@ -527,7 +524,7 @@ func curveName(crv elliptic.Curve) (string, error) {
|
||||
case elliptic.P521():
|
||||
return "P-521", nil
|
||||
default:
|
||||
return "", ErrUnsupportedEllipticCurve
|
||||
return "", ErrUnsupportedKeyType
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+14
@@ -43,6 +43,7 @@ type Signer interface {
|
||||
//
|
||||
// Key must have one of these types:
|
||||
// - ed25519.PrivateKey
|
||||
// - *mldsa.PrivateKey (requires Go 1.27 or later)
|
||||
// - *ecdsa.PrivateKey
|
||||
// - *rsa.PrivateKey
|
||||
// - *JSONWebKey
|
||||
@@ -224,6 +225,9 @@ func newVerifier(verificationKey interface{}) (payloadVerifier, error) {
|
||||
case OpaqueVerifier:
|
||||
return &opaqueVerifier{verifier: verificationKey}, nil
|
||||
default:
|
||||
if verifier, ok, err := mldsaVerifier(verificationKey); ok {
|
||||
return verifier, err
|
||||
}
|
||||
return nil, ErrUnsupportedKeyType
|
||||
}
|
||||
}
|
||||
@@ -255,6 +259,9 @@ func makeJWSRecipient(alg SignatureAlgorithm, signingKey interface{}) (recipient
|
||||
case OpaqueSigner:
|
||||
return newOpaqueSigner(alg, signingKey)
|
||||
default:
|
||||
if recipient, ok, err := mldsaSigner(alg, signingKey); ok {
|
||||
return recipient, err
|
||||
}
|
||||
return recipientSigInfo{}, ErrUnsupportedKeyType
|
||||
}
|
||||
}
|
||||
@@ -300,6 +307,12 @@ func (ctx *genericSigner) Sign(payload []byte) (*JSONWebSignature, error) {
|
||||
//
|
||||
// See https://github.com/square/go-jose/issues/157 for more context.
|
||||
if ctx.embedJWK {
|
||||
// MarshalJSON can fail for a semantically inconsistent key (an AKP
|
||||
// key whose Algorithm contradicts its parameter set). Surface that
|
||||
// as an error rather than letting mustSerializeJSON panic below.
|
||||
if _, err := recipientPubKey.MarshalJSON(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
protected[headerJWK] = recipientPubKey
|
||||
} else {
|
||||
keyID := recipientPubKey.KeyID
|
||||
@@ -381,6 +394,7 @@ func (ctx *genericSigner) Options() SignerOptions {
|
||||
//
|
||||
// The verificationKey argument must have one of these types:
|
||||
// - ed25519.PublicKey
|
||||
// - *mldsa.PublicKey (requires Go 1.27 or later)
|
||||
// - *ecdsa.PublicKey
|
||||
// - *rsa.PublicKey
|
||||
// - *JSONWebKey
|
||||
|
||||
Vendored
+1
-1
@@ -182,7 +182,7 @@ github.com/fxamacker/cbor/v2
|
||||
# github.com/go-errors/errors v1.5.1
|
||||
## explicit; go 1.14
|
||||
github.com/go-errors/errors
|
||||
# github.com/go-jose/go-jose/v4 v4.1.7
|
||||
# github.com/go-jose/go-jose/v4 v4.1.9
|
||||
## explicit; go 1.24.0
|
||||
github.com/go-jose/go-jose/v4
|
||||
github.com/go-jose/go-jose/v4/cipher
|
||||
|
||||
Reference in new issue
Block a user