Convert RSA envelope encryption to JWE #767
Conversation
SgtCoDFish
force-pushed
the
jwe
branch
2 times, most recently
from
9a85e11 to
8b85fa9
Compare
SgtCoDFish
force-pushed
the
jwe
branch
2 times, most recently
from
41454cb to
00389ff
Compare
| defer func() { | ||
| for i := range aesKey { | ||
| aesKey[i] = 0 | ||
| } | ||
| }() |
There was a problem hiding this comment.
note: we could generate the key outside of jwe.Encrypt and pass it in using WithKey, and keep our zeroising function here. Since we have to pass the key into a third party library in that case, I don't think we really gain much by zeroising here (we can't control what that third party does when the library updates).
This is what go1.26's secret.Do will be for. For now, having the jwe library generate the key means we never have to touch it in our code in plaintext.
SgtCoDFish
force-pushed
the
jwe
branch
2 times, most recently
from
6f28709 to
5231bd5
Compare
|
Looks good to me. I haven't dug into the cryptographic side of things. My only remark was that we are relying on RSA key signature but not a big deal. While reviewing, I've discovered an interesting CLI named I wish I had been able to test the new library using |
Uses github.com/lestrrat-go/jwx/v3, should be the same functionality as before Signed-off-by: Ashley Davis <ashley.davis@cyberark.com>
This matches what the upstream will expect - we agreed last week to use JWE in this case. To make it easier to migrate to other encodings later, I make the EncryptedData struct depend on a tag.
Important: This code still remains unused! The aim is to get the cryptography correct for now - we'll use it later.
Uses the github.com/lestrrat-go/jwx/v3 library, which seemed like the best choice from the ones I surveyed (e.g. https://github.com/golang-jwt/jwe has 2 contributors and no commits for 4 years)