change oid lookup for signing #29

nbutkowski-chub · 2022-10-22T06:05:44Z

When pulling the OID from SubjectPublicKeyInfo, we can get values like rsaEncryption (1.2.840.113549.1.1) which breaks @peculiar/webcrypto. Their docs indicate This one should not be used for signing.

I don't know enough to say if this is safer, but it appears to be working when testing with a key/cert generated this way:

openssl version
OpenSSL 3.0.5 5 Jul 2022 (Library: OpenSSL 3.0.5 5 Jul 2022)
openssl req -nodes -new -x509 -keyout test.key -out test.cer
openssl asn1parse -in test.cer -item X509 | grep algorithm
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
algorithm: rsaEncryption (1.2.840.113549.1.1.1)
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)

When pulling the OID from SubjectPublicKeyInfo, we can get values like rsaEncryption (1.2.840.113549.1.1) which breaks @peculiar/webcrypto. Their docs indicate This one should not be used for signing. I don't know enough to say if this is safer, but it appears to be working when testing with a key/cert generated this way: > openssl version OpenSSL 3.0.5 5 Jul 2022 (Library: OpenSSL 3.0.5 5 Jul 2022) > openssl req -nodes -new -x509 -keyout test.key -out test.cer > openssl asn1parse -in test.cer -item X509 | grep algorithm algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11) algorithm: rsaEncryption (1.2.840.113549.1.1.1) algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)