From 293d9f50d8670e5b2755e76bfd2846128c3a9baf Mon Sep 17 00:00:00 2001 From: Ben McClelland Date: Tue, 8 Sep 2026 15:24:12 -0700 Subject: [PATCH] fix: deprecations in JWK and IPA RSA handling Go 1.26 marks PKCS#1 v1.5 RSA encryption and direct ECDSA public-key coordinate access as deprecated. The IPA code path uses rsa.EncryptPKCS1v15 to wrap an AES session key for vault retrieval, and the OIDC JWKS parser rebuilt EC public keys by setting ecdsa.PublicKey.X and Y directly. This change replaces the deprecated RSA wrap with rsa.EncryptOAEP using SHA-256, which is the standard safe replacement for PKCS#1 v1.5 encryption and preserves the same protocol semantics for the IPA vault exchange. For EC JWKs, it reconstructs the raw uncompressed public point and parses it through ecdsa.ParseUncompressedPublicKey, which is the supported Go API for EC public keys and avoids mutating deprecated fields while preserving the exact mathematical key value. These changes do not alter the wire protocol or trust decisions; they only migrate to the supported stdlib APIs for equivalent behavior. --- auth/iam_ipa.go | 3 ++- iamapi/internal/iamutil/webidentity.go | 14 +++++++++----- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/auth/iam_ipa.go b/auth/iam_ipa.go index 2cd5ea40..490d4948 100644 --- a/auth/iam_ipa.go +++ b/auth/iam_ipa.go @@ -19,6 +19,7 @@ import ( "crypto/cipher" "crypto/rand" "crypto/rsa" + "crypto/sha256" "crypto/tls" "crypto/x509" "encoding/base64" @@ -168,7 +169,7 @@ func (ipa *IpaIAMService) GetUserAccount(access string) (Account, error) { return account, fmt.Errorf("ipa cannot generate session key: %w", err) } - encryptedKey, err := rsa.EncryptPKCS1v15(rand.Reader, ipa.kraTransportKey, session_key) + encryptedKey, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, ipa.kraTransportKey, session_key, nil) if err != nil { return account, fmt.Errorf("ipa vault secret retrieval: %w", err) } diff --git a/iamapi/internal/iamutil/webidentity.go b/iamapi/internal/iamutil/webidentity.go index e72f1cb8..4a27761c 100644 --- a/iamapi/internal/iamutil/webidentity.go +++ b/iamapi/internal/iamutil/webidentity.go @@ -543,11 +543,15 @@ func (k jwk) publicKey() (any, error) { if err != nil { return nil, fmt.Errorf("decode EC y: %w", err) } - return &ecdsa.PublicKey{ - Curve: curve, - X: new(big.Int).SetBytes(xb), - Y: new(big.Int).SetBytes(yb), - }, nil + x := new(big.Int).SetBytes(xb) + y := new(big.Int).SetBytes(yb) + keyBytes := make([]byte, 1+(curve.Params().BitSize+7)/8*2) + keyBytes[0] = 0x04 + xBytes := x.FillBytes(make([]byte, (curve.Params().BitSize+7)/8)) + yBytes := y.FillBytes(make([]byte, (curve.Params().BitSize+7)/8)) + copy(keyBytes[1:1+len(xBytes)], xBytes) + copy(keyBytes[1+len(xBytes):], yBytes) + return ecdsa.ParseUncompressedPublicKey(curve, keyBytes) default: return nil, fmt.Errorf("unsupported JWK key type %q", k.Kty) }