René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"RSA-PSS fails to verify","articleBody":"From @dickhardt\n\nTurns out it's a salt length mismatch. Go's crypto/rsa defaults to PSSSaltLengthAuto, which stuffs in as much salt as the key can hold (~190 bytes for a 2048-bit key with SHA-512). On the JS side, WebCrypto wants you to specify saltLength explicitly, and the IETF consensus (CFRG list actually discussed this for HTTP Message Signatures specifically) is to follow TLS 1.3: salt length = hash output length, so 64 bytes for SHA-512.\n\nSo your side signs with ~190 bytes of salt, our side tries to verify expecting 64 bytes, and it blows up.\n\nIf you set rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash} in httpsign, that should fix it for any implementation following the TLS 1.3 / CFRG convention — which is basically everyone except Go's default.\n\nReferences:\n- CFRG discussion on RSA-PSS salt length for HTTP Message Signatures: https://mailarchive.ietf.org/arch/msg/cfrg/sWbRsGgrOyd1Os-9Pj902wGoc-8/\n- RFC 9421 Section 3.3.1 - HTTP Message Signatures (explicitly requires 64-byte salt): https://httpwg.org/specs/rfc9421.html#name-rsassa-pss-using-sha-512\n- Go crypto/rsa PSS docs: https://pkg.go.dev/crypto/rsa\n- WebCrypto RsaPssParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaPssParams","author":{"url":"https://github.com/yaronf","@type":"Person","name":"yaronf"},"datePublished":"2026-03-02T13:15:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/17/httpsign/issues/17"}