Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Opaque does not appear to correctly support PBES* parameters #114

Open
jason-baker opened this issue Apr 16, 2024 · 0 comments
Open

Opaque does not appear to correctly support PBES* parameters #114

jason-baker opened this issue Apr 16, 2024 · 0 comments

Comments

@jason-baker
Copy link

The long test times in #112 are most likely due to PBES* tests. The recent release updated the default cycle count from 100k to 600k. This results in a roughly 4x increase in test runtime (~100s to 400s locally). When trying to locally develop a patch for the problematic algorithm runtime I believe I have found the root cause:

go-jose/shared.go

Lines 93 to 95 in aabe78e

PBES2_HS256_A128KW = KeyAlgorithm("PBES2-HS256+A128KW") // PBES2 + HMAC-SHA256 + AES key wrap (128)
PBES2_HS384_A192KW = KeyAlgorithm("PBES2-HS384+A192KW") // PBES2 + HMAC-SHA384 + AES key wrap (192)
PBES2_HS512_A256KW = KeyAlgorithm("PBES2-HS512+A256KW") // PBES2 + HMAC-SHA512 + AES key wrap (256)
)

The Opaque signer does not appear to respect PBES2Count & PBES2Salt from the Recipient structure:

go-jose/crypter.go

Lines 136 to 137 in aabe78e

PBES2Count int
PBES2Salt []byte

I believe if this is fixed, or PBES is not supported for opaque, and the tests are updated to set a much lower cycle count the entire test suite will complete in seconds instead of minutes. Local testing showed that of the ~400 seconds about 380 seconds were spent doing PBES iterations when permuted across all of the other encryption options etc...

It can be seen that this is done for the other much faster roundtrip JWE tests (2.5s locally):

rcpt = Recipient{Algorithm: keyAlg, Key: encryptionKey, PBES2Count: 1000}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant