Skip to content

Update ZCrypto, thereby allowing parsing of RSA public keys with very large exponents#714

Merged
zakird merged 9 commits into
masterfrom
phillip/670-rsa-large-e
May 15, 2026
Merged

Update ZCrypto, thereby allowing parsing of RSA public keys with very large exponents#714
zakird merged 9 commits into
masterfrom
phillip/670-rsa-large-e

Conversation

@phillip-stephens

Copy link
Copy Markdown
Contributor

As reported in #670, we were unable to parse RSA keys with very large exponents (larger than Go's int). The fix was to bring in the crypto/rsa into zcrypto and update it to use big.Int.

How to Test

I created Dockerfile to create an SSH and TLS server with RSA encryption and large values for E. I confirmed that on master I get:

{"ip":"127.0.0.1","port":2222,"data":{"ssh":{"status":"handshake-error","protocol":"ssh","port":2222,"timestamp":"2026-05-14T16:56:43+12:00","error":"failed to create SSH client connection: ssh: handshake failed: ssh: exponent too large"}}}

TLS

...
"error":"could not successfully complete tls handshake for target 127.0.0.1: tls: failed to parse certificate from server: asn1: structure error: integer too large"}}}

And after fix parsing happens correctly:

"subject_key_info":{"key_algorithm":{"name":"RSA"},"rsa_public_key":{"exponent":18055167462020576832540418801269399449497458945579819352363471260881145217415187933979886593216702486709838548298363314547135313727007388848848718877325958711188766129904621880761442689187401184009426273984277684003122213085277946304575120619200203923589966657977707649865400135198719640242827758871490643836453581086290290070463208430162495075066127540155058688548796517517682461188204549669427084215413151090479072676858203077338724804689901318804911869834305119181949193084540411547590690852877796014237632488428719014037051865845914633544290925724386331615109209841,"modulus":"...","length":2048},"fingerprint_sha256":"6e5b1a90509c51ff8963a0ceb6771724c074b7445eb9523e3f524cbc8aa8b25d"}

Issue Tracking

Resolves #670

@phillip-stephens phillip-stephens force-pushed the phillip/670-rsa-large-e branch from 524c6e0 to abe2efd Compare May 14, 2026 05:08
@phillip-stephens phillip-stephens marked this pull request as ready for review May 14, 2026 23:37
@phillip-stephens phillip-stephens requested a review from zakird May 14, 2026 23:38
@zakird zakird merged commit 8773797 into master May 15, 2026
29 checks passed
@zakird zakird deleted the phillip/670-rsa-large-e branch May 15, 2026 03:07
@hdm

hdm commented May 15, 2026

Copy link
Copy Markdown

howdy! i pulled this into runZeroInc/excrypto#78 as well - noticed a few small issues (other places where E was being limited); should be clear in the diffs if you'd like to pull these back too

@phillip-stephens

Copy link
Copy Markdown
Contributor Author

Awesome, I'll pull those in, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSH RSA keys with large e value are not captured (and X.509 keys not parsed)

3 participants