feat: add RSA-PSS (RSASSA-PSS) signature algorithm support

[leifj]

Summary

Add RSA-PSS signature algorithm support for both signing and verification, as specified in RFC 6931 Section 2.3.10.

Motivation

RSA-PSS is commonly required in EU contexts, particularly for validating German Trust Service List (TSL) signatures which use RSA-PSS with certificates that have RSA-PSS encoded public keys (OID 1.2.840.113549.1.1.10).

Changes

Signature algorithms added:

• http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1 (SHA256WithRSAPSS)
• http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1 (SHA384WithRSAPSS)
• http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1 (SHA512WithRSAPSS)

Verification enhancements:

• Special handling for certificates with RSA-PSS public keys (OID 1.2.840.113549.1.1.10), which Go's x509 library cannot parse natively
• Manual RSA public key extraction from DER-encoded certificates with RSA-PSS algorithm identifiers
• verifyRSAPSSSignature() for manual PSS verification when CheckSignature fails due to the RSA-PSS OID

Signing:

• RSA-PSS signing support via rsa.SignPSS with PSSSaltLengthEqualsHash

Testing

All existing tests continue to pass.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the cryptographic capabilities by introducing comprehensive support for RSA-PSS (RSASSA-PSS) digital signatures. This addition addresses a critical need, particularly for compliance with European regulations and the validation of German Trust Service List (TSL) signatures, which frequently utilize RSA-PSS with specific certificate structures. The changes enable both the creation and verification of XML digital signatures using RSA-PSS, including custom handling for certificates that embed RSA-PSS public keys, which are not natively supported by Go's standard library.

Highlights

• RSA-PSS Algorithm Support: Full support for RSA-PSS (RSASSA-PSS) signature algorithms has been added for both signing and verification, aligning with RFC 6931 Section 2.3.10.
• New Signature Algorithms: Three new XMLDSig-more URIs for RSA-PSS with SHA256, SHA384, and SHA512 hashing algorithms have been introduced.
• RSA-PSS Certificate Handling: Special handling was implemented to parse and extract RSA public keys from certificates that use the RSA-PSS OID (1.2.840.113549.1.1.10), as Go's native x509 library does not support this directly.
• Manual PSS Verification: A verifyRSAPSSSignature() function was added to manually perform PSS verification when standard CheckSignature fails due to the presence of an RSA-PSS OID in the certificate.
• RSA-PSS Signing: RSA-PSS signing is now supported using rsa.SignPSS with PSSSaltLengthEqualsHash for salt length.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

The pull request successfully adds support for RSA-PSS (RSASSA-PSS) signature algorithms for both signing and verification. The implementation correctly handles the complexities of certificates with RSA-PSS public keys, which Go's x509 library does not natively support, through custom ASN.1 parsing and manual verification. The changes are well-structured and integrate smoothly with the existing codebase.

[adamdecaf]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces comprehensive support for RSA-PSS (RSASSA-PSS) signature algorithms within the signedxml library. This includes registering the new algorithms, updating the Signer to use rsa.SignPSS for signing, and significantly enhancing the Validator to correctly verify RSA-PSS signatures. The validation logic now includes custom parsing for X.509 certificates that use RSA-PSS public keys, addressing a limitation in Go's standard x509 library. No specific feedback was provided in the review comments.

[adamdecaf]

Thank you! Do you have an example test or to we could include to confirm this works?

[adamdecaf]

I've added one with f22487e

These commits are merged, thanks!