RSA-SHA256 encryption is broken after updates as of 03/22/2016

[browserify]

RSA-SHA256 encryption is broken after updates as of 03/22/2016

[fanatid]

@vadim-repin can you clarify, what version of browserify-sign fails?
also, can you paste full code for reproducing bug? (data, pKey, stacktrace if it's possible)

[vadim-repin]

@fanatid the version is 4.0.0.

var crypto = require('crypto-browserify');

module.exports = {
createSignature: function(data, key) {
var pKey = key;
if (typeof data !== 'string') {
JSON.stringify(data);
}
return crypto.createSign('RSA-SHA256').update(data).sign(pKey, 'base64');
}
};

data = any valid JSON;
key using random private key from http://travistidwell.com/blog/2013/09/06/an-online-rsa-public-and-private-key-generator/

Unfortunately I can't provide you with full error stack, because I'm minifying files and browserify makes things even more complicated.

[fanatid]

It works in my firefox (with [email protected]):

var crypto = require('crypto-browserify')

var pKey = `-----BEGIN RSA PRIVATE KEY-----
MIIBOAIBAAJAe1/pETJjFE1iOQND60VzJfUa0RWZWZJj3OaXosU7LYqHafbEeFhl
LNyDIMOOEPp4Z/pXL8HQYg8glKdfH/3y0QIDAQABAkAgInUkY4lnCljhHLaeGzLI
2jSn7QZKTFTyfqVUYibtz2A3a5BizrHMN+GoQrabliRJs/dyfA7vZi1VR3g8G415
AiEAxF6PGdY8DVV1x7QqrKnaPXYt2w4By4k5POJCzaMUtK8CIQCg1tvG2idP2Wps
W4ZkHOEQgVEhuQSYIFrXrWba64CwfwIgWmI/sZ+3ElgUly/pOIIRjpqXrqz6zIlD
zC9EmkwG2scCIBCiaBSG124AtGsEhD+yZOyKE1QDiKAbKIoJ2wtlM+gNAiAVmoBi
+0iZToce2P0oG+cpbF7+xv3ZnffxMvB+X5Ax/g==
-----END RSA PRIVATE KEY-----`

var data = JSON.stringify({ answer: 42 })

var sig = crypto.createSign('RSA-SHA256').update(data).sign(pKey, 'base64')
console.log(sig)
// BMq1gbcoqu1YxO+8d/nSVKRsttLwPLP7ZvxsLflTHEjQsuBJ5JHFUWxb39PJWSC0KczsVm4wFxuc8R0DGWSS7A==

[vadim-repin]

Okay, will investigate why 3.0.8 works and 4.0.0 fails. Thanks. Will let you know.

[fanatid]

@vadim-repin what was the problem?

[vadim-repin]

@fanatid still investigating.

[fanatid]

please let know about results

[vadim-repin]

@fanatid well it was gulp-uglify that messed things up, wonder why force downgrade to 3.0.8 worked fine.

[calvinmetcalf]

indutny/bn.js#133