mirror of
https://github.com/versity/versitygw.git
synced 2026-09-22 16:04:15 +00:00
Ben McClelland
293d9f50d8
Go 1.26 marks PKCS#1 v1.5 RSA encryption and direct ECDSA public-key coordinate access as deprecated. The IPA code path uses rsa.EncryptPKCS1v15 to wrap an AES session key for vault retrieval, and the OIDC JWKS parser rebuilt EC public keys by setting ecdsa.PublicKey.X and Y directly. This change replaces the deprecated RSA wrap with rsa.EncryptOAEP using SHA-256, which is the standard safe replacement for PKCS#1 v1.5 encryption and preserves the same protocol semantics for the IPA vault exchange. For EC JWKs, it reconstructs the raw uncompressed public point and parses it through ecdsa.ParseUncompressedPublicKey, which is the supported Go API for EC public keys and avoids mutating deprecated fields while preserving the exact mathematical key value. These changes do not alter the wire protocol or trust decisions; they only migrate to the supported stdlib APIs for equivalent behavior.