Skip to content

Commit

Permalink
Remove unnecessary test dependencies on RSA-512 (#11444)
Browse files Browse the repository at this point in the history
* Remove unnecessary test dependencies on RSA-512

test_unsupported_hash and test_prehashed_digest_mismatch work just fine
with realistic RSA key sizes. (They also, as written, silently test
nothing when the backend rejects RSA-512. As a reminder, RSA-512 was
broken since 1999.)

test_rsa_fips_small_key wants a small key, but I assume RSA-1024 is
fine.

* Keep using RSA-512 for test_rsa_fips_small_key as a RHEL-8 accommodation
  • Loading branch information
davidben authored Aug 17, 2024
1 parent 8755923 commit c2aad20
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions tests/hazmat/primitives/test_rsa.py
Original file line number Diff line number Diff line change
Expand Up @@ -821,8 +821,8 @@ def test_prehashed_digest_length(
),
skip_message="Does not support PSS.",
)
def test_unsupported_hash(self, rsa_key_512: rsa.RSAPrivateKey, backend):
private_key = rsa_key_512
def test_unsupported_hash(self, rsa_key_2048: rsa.RSAPrivateKey, backend):
private_key = rsa_key_2048
message = b"one little message"
pss = padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=0)
with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_HASH):
Expand Down Expand Up @@ -850,9 +850,9 @@ def test_unsupported_hash_pss_mgf1(self, rsa_key_2048: rsa.RSAPrivateKey):
skip_message="Does not support PSS.",
)
def test_prehashed_digest_mismatch(
self, rsa_key_512: rsa.RSAPrivateKey, backend
self, rsa_key_2048: rsa.RSAPrivateKey, backend
):
private_key = rsa_key_512
private_key = rsa_key_2048
message = b"one little message"
h = hashes.Hash(hashes.SHA512(), backend)
h.update(message)
Expand Down Expand Up @@ -2137,6 +2137,8 @@ def test_rsa_encrypt_key_too_small(self, key_data, pad, backend):
skip_message="Requires FIPS",
)
def test_rsa_fips_small_key(self, rsa_key_512: rsa.RSAPrivateKey, backend):
# Ideally this would use a larger disallowed key like RSA-1024, but
# RHEL-8 thinks that RSA-1024 is allowed by FIPS.
with pytest.raises(ValueError):
rsa_key_512.sign(b"somedata", padding.PKCS1v15(), hashes.SHA512())

Expand Down

0 comments on commit c2aad20

Please sign in to comment.