Skip to content

Add tests for RSASSA-PSS with SHA-3 digest and MGF1 - #3377

Merged
WillChilds-Klein merged 3 commits into
aws:mainfrom
WillChilds-Klein:rsa-pss-sha3-tests
Jul 27, 2026
Merged

Add tests for RSASSA-PSS with SHA-3 digest and MGF1#3377
WillChilds-Klein merged 3 commits into
aws:mainfrom
WillChilds-Klein:rsa-pss-sha3-tests

Conversation

@WillChilds-Klein

@WillChilds-Klein WillChilds-Klein commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Adds test coverage proving RSASSA-PSS supports SHA-3 and all SHA-2 variants as both the message digest and the MGF1 hash. No library code changes -- this capability already works because the PSS padding, sign, and verify paths drive the digest through the abstract EVP_MD interface with no digest allowlist.

Testing

  • crypto/rsa_extra/rsa_test.cc -- new test covers the low-level padding functions (RSA_padding_add_PKCS1_PSS_mgf1 / RSA_verify_PKCS1_PSS_mgf1) and sign/verify (RSA_sign_pss_mgf1 / RSA_verify_pss_mgf1) with SHA3-256/384/512, plus a mismatched message-digest/MGF1-digest case (SHA3-256 hash with SHA3-512 mask) and a negative control.
  • crypto/evp_extra/evp_tests.txt -- file-driven vectors covering the EVP layer (EVP_PKEY_sign/verify with EVP_PKEY_CTX_set_rsa_mgf1_md), round-tripped via CheckVerify.

Note

The one place SHA-3 is not accepted for PSS is the ASN.1 parameter allowlist in crypto/rsa_extra/rsassa_pss_asn1.c (SHA1/224/256/384/512 only), which is exercised only for restricted EVP_PKEY_RSA_PSS keys. These tests deliberately use plain RSA keys and the direct APIs, which are unaffected.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@WillChilds-Klein
WillChilds-Klein requested a review from a team as a code owner July 27, 2026 14:42
github-actions[bot]
github-actions Bot reviewed Jul 27, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clang-tidy made some suggestions

Comment thread crypto/rsa_extra/rsa_test.cc Resolved
Comment thread crypto/rsa_extra/rsa_test.cc Resolved
github-actions[bot]
github-actions Bot reviewed Jul 27, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clang-tidy made some suggestions

Comment thread crypto/rsa_extra/rsa_test.cc Resolved
Comment thread crypto/rsa_extra/rsa_test.cc Resolved
justsmth
justsmth previously approved these changes Jul 27, 2026
View reviewed changes

@justsmth justsmth left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description needs to be updated per the changes in the second commit.

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

🔒 Security Review — View Report

Please review before merging.

@codecov-commenter

codecov-commenter commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.39%. Comparing base (0ab5b00) to head (d50490d).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #3377      +/-   ##
==========================================
+ Coverage   78.38%   78.39%   +0.01%     
==========================================
  Files         695      695              
  Lines      124195   124224      +29     
  Branches    17266    17266              
==========================================
+ Hits        97352    97390      +38     
+ Misses      25917    25908       -9     
  Partials      926      926

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@WillChilds-Klein
WillChilds-Klein enabled auto-merge (squash) July 27, 2026 16:39
@WillChilds-Klein
Add tests for RSASSA-PSS with SHA-3 digest and MGF1
18f3b4f 
RSASSA-PSS already supports SHA-3 for both the message digest and the
MGF1 hash: the padding, sign, and verify paths drive the digest entirely
through the abstract EVP_MD interface with no digest allowlist. Add tests
proving this at two layers.

- crypto/rsa_extra/rsa_test.cc: RSATest.PSSWithSHA3 exercises the
  low-level padding functions (RSA_padding_add_PKCS1_PSS_mgf1 /
  RSA_verify_PKCS1_PSS_mgf1) and the sign/verify functions
  (RSA_sign_pss_mgf1 / RSA_verify_pss_mgf1) with SHA3-256/384/512,
  including a case where the message digest and MGF1 digest differ.

- crypto/evp_extra/evp_tests.txt: file-driven vectors covering the EVP
  layer (EVP_PKEY_sign/verify with EVP_PKEY_CTX_set_rsa_mgf1_md),
  round-tripped via CheckVerify.
@WillChilds-Klein
Cover SHA-2 digests and rename PSS test
0f468b4 
Broaden the RSA-PSS digest test to also cover SHA-224/256/384/512 (in
addition to the SHA-3 variants), including a mismatched SHA-256/SHA-512
message-digest/MGF1-digest case. Rename it to PSSWithVariousDigests to
reflect that it spans multiple digest families rather than just SHA-3.
@WillChilds-Klein
Regenerate generated-src for new RSA-PSS test vectors
d50490d 
The pre_push_checker CI job regenerates generated-src and compares it
against the committed copy. Adding RSA-PSS SHA-3 vectors to
crypto/evp_extra/evp_tests.txt changed the embedded test data in
generated-src/crypto_test_data.cc.tar.bz2, so regenerate it to match.
@WillChilds-Klein
WillChilds-Klein merged commit 969c3dc into aws:main Jul 27, 2026
545 of 549 checks passed
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
HarmonybrewBot HarmonybrewBot
!15934 merge bump-aws-lc-5.5.0 into main
365c6f6 
aws-lc 5.5.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## What's Changed
* Restore ADX/AVX2 code paths under OPENSSL_SMALL via new MY_ASSEMBLER_IS_TOO_OLD_FOR_ADX_AVX2 flag by @justsmth in aws/aws-lc#3368
* Include <openssl/cipher.h> from <openssl/hmac.h> for OpenSSL compat by @justsmth in aws/aws-lc#3371
* ci: harden security-review.yml against script injection by @nebeid in aws/aws-lc#3365
* Fix flaky s_client cipher tests by using better ciphers by @justsmth in aws/aws-lc#3373
* chore: simplify the api docs workflow by @dougch in aws/aws-lc#3186
* Add tests for RSASSA-PSS with SHA-3 digest and MGF1 by @WillChilds-Klein in aws/aws-lc#3377
* Link header documentation from README by @WillChilds-Klein in aws/aws-lc#3378
* Rename autofix reasoning role to AwsLcGitHubActionsBedrockRole by @tianyiy-tim in aws/aws-lc#3376
* ci: pin openssh required job by @dougch in aws/aws-lc#3387
* delocate: Drop redundant `-dI` flag by @hanno-becker in aws/aws-lc#3384
* Add Neoverse-V3 (Graviton5) detection and dispatch by @nebeid in aws/aws-lc#3374
* Bump ring from 0.17.8 to 0.17.14 in /tests/ci/lambda by @dependabot[bot] in aws/aws-lc#3375
* Fix docker image dependencies and update octocrab initialization by @prasden in aws/aws-lc#3388
* Update FIPS.md by @justsmth in aws/aws-lc#3382
* Bump urllib3 from 2.6.3 to 2.7.0 in /tests/ci by @dependabot[bot] in aws/aws-lc#3372
* Add MinGW shared-library Windows CI coverage by @justsmth in aws/aws-lc#3398
* Update concurrency in `security-review` by @nhatnghiho in aws/aws-lc#3403
* Enable linker garbage collection for non-FIPS static builds by @justsmth in aws/aws-lc#3397
* Prepare 5.5.0 by @justsmth in aws/aws-lc#3401

## New Contributors
* @tianyiy-tim made their first contribution in aws/aws-lc#3376

**Full Changelog**: https://github.com/aws/aws-lc/compare/v5.4.0...v5.5.0</pre>
  <p>View the full release notes at <a href="https://github.com/aws/aws-lc/releases/tag/v5.5.0">https://github.com/aws/aws-lc/releases/tag/v5.5.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!15934

This branch was previously deployed

1 inactive deployment
auto-approve — d50490d3 Deployed Jul 27, 2026 by WillChilds-Klein via android-debug-shared #1619
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@jakemas jakemas jakemas approved these changes
@justsmth justsmth justsmth approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@WillChilds-Klein @codecov-commenter @jakemas @justsmth