Repository navigation
Reject unsupported multi-prime RSA JWKs - #190
Merged
Merged
Conversation
This was referenced Sep 13, 2026
TheStormN
pushed a commit
that referenced
this pull request
Sep 15, 2026
The 1.0.0 section carried only the Breaking list that #187 wrote, so nothing merged after it was recorded: the A*GCMKW, PBES2, X25519/X448 and ML-DSA algorithms, the "crit" refusal and the JWE header disjointness, the JWK import refusals of #189, #190, #192 and #193, the NULL cjose_err crash of #191 and the EVP_Q_mac change of #196. The entries reference pull requests, as the rest of that section does, rather than the commit links the released sections use. The "crit" refusal is listed as breaking because it refuses a JWE or JWS that 0.8.0 accepted. Three more rules do the same without changing the API, so they stay under Fix and a Compatibility paragraph names them, the way the 0.8.1 notes do: the disjointness of the header locations, the refusal of a header parameter the algorithm generates, and the refusal of a valueless private member in an RSA or EC key. 0.8.1 was released from the 0.8.x branch on 2026-09-14 and its section only ever existed there, so this file jumped from the unreleased 1.0.0 straight to 0.8.0 and the release was invisible here. It is copied over unchanged. The README already describes the ML-DSA algorithms, the AKP key type and the CJOSE_ENABLE_ML_DSA option; the only thing missing was the OpenSSL requirement in the prerequisites, which named 3.0.0 alone. Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
TheStormN
pushed a commit
that referenced
this pull request
Sep 15, 2026
Three sentences #199 added describe the 0.8.x line or an earlier commit rather than what main does, found by a review of the merged text against the source at 0.8.0 and at each pull request. The generated-parameter entry said the check for a caller-supplied "epk" had read it as a string and so never saw one. That defect existed only on the 0.8.x backport, whose 0.8.1 notes the sentence was taken from; on main the helper has looked the parameter up as JSON since #188 introduced it. What 0.8.0 did on main was silently replace a protected "epk" with the generated one, and leave one in the shared or a per-recipient header beside it. The RSA private-member entry gave "imported as a public key" as the outcome for every valueless form. That is true of an empty, null or padding-only member (#189, #192) but not of a zero one (#193), which imported as a private key whose export cjose could not read back, as the 0.8.1 section below it already says. The Compatibility paragraph counted three rules that refuse input 0.8.0 accepted and missed two: the "oth" refusal of #190, since 0.8.0 knew no such member and imported a multi-prime key as a two-prime one, and the refusal of an "epk" naming a private member of #186. It also listed "iv", "tag" and "p2s" as if 0.8.0 had accepted them, when the algorithms that use them are new in this release. The paragraph now names the rules without counting them. Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cjosesupports only two-prime RSA keys. RFC 7518 section 6.3.2.7 defines theothparameter for RSA keys with three or more prime factors and requires consumers that do not support multi-prime keys not to use such keys.Previously, RSA JWK import ignored
othand could silently interpret an unsupported key as a two-prime RSA key.This change rejects any RSA JWK containing
othwithCJOSE_ERR_INVALID_ARGbefore importing the key material.Testing
otharray.nullothvalue.