[Key Vault] Add warnings to RSA_1_5 and RSA-OAEP documentation (Azure…

…#32289)
test-repo-billy · Jan 24, 2025 · b8adce1 · b8adce1
1 parent 63d3600
commit b8adce1
Show file tree

Hide file tree

Showing 7 changed files with 14 additions and 14 deletions.
diff --git a/specification/keyvault/Security.KeyVault.Keys/examples/7.5/wrapKey-example.json b/specification/keyvault/Security.KeyVault.Keys/examples/7.5/wrapKey-example.json
@@ -5,15 +5,15 @@
     "key-version": "0698c2156c1a4e1da5b6bab6f6422fd6",
     "api-version": "7.5",
     "parameters": {
-      "alg": "RSA1_5",
+      "alg": "RSA-OAEP-256",
       "value": "ovQIlbB0DgWhZA7sgkPxbg9H-Ly-VlNGPSgGrrZvlIo"
     }
   },
   "responses": {
     "200": {
       "body": {
         "kid": "https://myvault.vault.azure.net/keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6",
-        "value": "khwIe26NuAZazS7upywDBpGRmRNMW5-4h_JQKxOdB78nYVxZWnBXwCxOv7a3Sr_mCjiVzKsoQQZwL-CJzhYa0512tfYem56zls5a44y5QsdcfvuSzOvpthVhA9XkEfCJSqSY_sip5d8BelT_w_ikvd_8KqiQ_0H54RqYUN8svCpu28paHgBocHFNXTQ9NtU9ec2qgESXk7Jp4OTy9HJtQJavKDUqTJ3YmtLxUgsgBCe0FNMHUSEYC0Ys6PavYzdTwIzYCq84idmAxJOj-O_6eALJFH2sDTOQYHjzOae2t8eFmw6C-t55qjrCI91a9mUJEGPhYixiG4gR4PaEJ7wGvw"
+        "value": "jdweWJO8dmKw4feBggZGyiMcgTnxS6QycpTSKEZd9VV9munW+STSr45GimVdOXbBowArlrUDGUhrCa7Z1vv4HgwOPhKomDNSAgqt0t/TgPiIVWSN+cMcARj0Y8/hrZVzlu+IlWBv/MVyPoytASyH8eF1L3UQa4Xh8Ebpjvs9yAZsr9tWG2Q1sn4jKetRBJHz44IV4g2rTgut+rZHK9ubdNB91nzqoRuN162uQkKlC7tBuBASd53gOAeaxedTt1RuW7w56XzSx2k/60ehmBcNuLaYAds7g4e8qec1k+u6rc2scU4n+RHuZTvqXkwpEYUsAqKKn8G7wylSWjHszNUEUw"
       }
     }
   },

diff --git a/specification/keyvault/Security.KeyVault.Keys/examples/7.6-preview.1/wrapKey-example.json b/specification/keyvault/Security.KeyVault.Keys/examples/7.6-preview.1/wrapKey-example.json
@@ -5,15 +5,15 @@
     "key-version": "0698c2156c1a4e1da5b6bab6f6422fd6",
     "api-version": "7.6-preview.1",
     "parameters": {
-      "alg": "RSA1_5",
+      "alg": "RSA-OAEP-256",
       "value": "ovQIlbB0DgWhZA7sgkPxbg9H-Ly-VlNGPSgGrrZvlIo"
     }
   },
   "responses": {
     "200": {
       "body": {
         "kid": "https://myvault.vault.azure.net/keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6",
-        "value": "khwIe26NuAZazS7upywDBpGRmRNMW5-4h_JQKxOdB78nYVxZWnBXwCxOv7a3Sr_mCjiVzKsoQQZwL-CJzhYa0512tfYem56zls5a44y5QsdcfvuSzOvpthVhA9XkEfCJSqSY_sip5d8BelT_w_ikvd_8KqiQ_0H54RqYUN8svCpu28paHgBocHFNXTQ9NtU9ec2qgESXk7Jp4OTy9HJtQJavKDUqTJ3YmtLxUgsgBCe0FNMHUSEYC0Ys6PavYzdTwIzYCq84idmAxJOj-O_6eALJFH2sDTOQYHjzOae2t8eFmw6C-t55qjrCI91a9mUJEGPhYixiG4gR4PaEJ7wGvw"
+        "value": "jdweWJO8dmKw4feBggZGyiMcgTnxS6QycpTSKEZd9VV9munW+STSr45GimVdOXbBowArlrUDGUhrCa7Z1vv4HgwOPhKomDNSAgqt0t/TgPiIVWSN+cMcARj0Y8/hrZVzlu+IlWBv/MVyPoytASyH8eF1L3UQa4Xh8Ebpjvs9yAZsr9tWG2Q1sn4jKetRBJHz44IV4g2rTgut+rZHK9ubdNB91nzqoRuN162uQkKlC7tBuBASd53gOAeaxedTt1RuW7w56XzSx2k/60ehmBcNuLaYAds7g4e8qec1k+u6rc2scU4n+RHuZTvqXkwpEYUsAqKKn8G7wylSWjHszNUEUw"
       }
     }
   },

diff --git a/specification/keyvault/Security.KeyVault.Keys/models.tsp b/specification/keyvault/Security.KeyVault.Keys/models.tsp
@@ -146,7 +146,7 @@ union JsonWebKeyEncryptionAlgorithm {
   string,
 
   /**
-   * RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1.
+   * [Not recommended] RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_OAEP, which is included solely for backwards compatibility. RSA_OAEP utilizes SHA1, which has known collision problems.
    */
   RSA_OAEP: "RSA-OAEP",
 
@@ -155,7 +155,7 @@ union JsonWebKeyEncryptionAlgorithm {
    */
   RSA_OAEP256: "RSA-OAEP-256",
 
-  /** RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447. */
+  /** [Not recommended] RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_1_5, which is included solely for backwards compatibility. Cryptographic standards no longer consider RSA with the PKCS#1 v1.5 padding scheme secure for encryption. */
   RSA1_5: "RSA1_5",
 
   /** 128-bit AES-GCM. */

diff --git a/...eyvault/data-plane/Microsoft.KeyVault/preview/7.6-preview.1/examples/wrapKey-example.json b/...eyvault/data-plane/Microsoft.KeyVault/preview/7.6-preview.1/examples/wrapKey-example.json
@@ -5,15 +5,15 @@
     "key-version": "0698c2156c1a4e1da5b6bab6f6422fd6",
     "api-version": "7.6-preview.1",
     "parameters": {
-      "alg": "RSA1_5",
+      "alg": "RSA-OAEP-256",
       "value": "ovQIlbB0DgWhZA7sgkPxbg9H-Ly-VlNGPSgGrrZvlIo"
     }
   },
   "responses": {
     "200": {
       "body": {
         "kid": "https://myvault.vault.azure.net/keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6",
-        "value": "khwIe26NuAZazS7upywDBpGRmRNMW5-4h_JQKxOdB78nYVxZWnBXwCxOv7a3Sr_mCjiVzKsoQQZwL-CJzhYa0512tfYem56zls5a44y5QsdcfvuSzOvpthVhA9XkEfCJSqSY_sip5d8BelT_w_ikvd_8KqiQ_0H54RqYUN8svCpu28paHgBocHFNXTQ9NtU9ec2qgESXk7Jp4OTy9HJtQJavKDUqTJ3YmtLxUgsgBCe0FNMHUSEYC0Ys6PavYzdTwIzYCq84idmAxJOj-O_6eALJFH2sDTOQYHjzOae2t8eFmw6C-t55qjrCI91a9mUJEGPhYixiG4gR4PaEJ7wGvw"
+        "value": "jdweWJO8dmKw4feBggZGyiMcgTnxS6QycpTSKEZd9VV9munW+STSr45GimVdOXbBowArlrUDGUhrCa7Z1vv4HgwOPhKomDNSAgqt0t/TgPiIVWSN+cMcARj0Y8/hrZVzlu+IlWBv/MVyPoytASyH8eF1L3UQa4Xh8Ebpjvs9yAZsr9tWG2Q1sn4jKetRBJHz44IV4g2rTgut+rZHK9ubdNB91nzqoRuN162uQkKlC7tBuBASd53gOAeaxedTt1RuW7w56XzSx2k/60ehmBcNuLaYAds7g4e8qec1k+u6rc2scU4n+RHuZTvqXkwpEYUsAqKKn8G7wylSWjHszNUEUw"
       }
     }
   },

diff --git a/specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.6-preview.1/keys.json b/specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.6-preview.1/keys.json
@@ -1577,7 +1577,7 @@
           {
             "name": "RSA_OAEP",
             "value": "RSA-OAEP",
-            "description": "RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1."
+            "description": "[Not recommended] RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_OAEP, which is included solely for backwards compatibility. RSA_OAEP utilizes SHA1, which has known collision problems."
           },
           {
             "name": "RSA_OAEP256",
@@ -1587,7 +1587,7 @@
           {
             "name": "RSA1_5",
             "value": "RSA1_5",
-            "description": "RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447."
+            "description": "[Not recommended] RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_1_5, which is included solely for backwards compatibility. Cryptographic standards no longer consider RSA with the PKCS#1 v1.5 padding scheme secure for encryption."
           },
           {
             "name": "A128_GCM",

diff --git a/...ification/keyvault/data-plane/Microsoft.KeyVault/stable/7.5/examples/wrapKey-example.json b/...ification/keyvault/data-plane/Microsoft.KeyVault/stable/7.5/examples/wrapKey-example.json
@@ -5,15 +5,15 @@
     "key-version": "0698c2156c1a4e1da5b6bab6f6422fd6",
     "api-version": "7.5",
     "parameters": {
-      "alg": "RSA1_5",
+      "alg": "RSA-OAEP-256",
       "value": "ovQIlbB0DgWhZA7sgkPxbg9H-Ly-VlNGPSgGrrZvlIo"
     }
   },
   "responses": {
     "200": {
       "body": {
         "kid": "https://myvault.vault.azure.net/keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6",
-        "value": "khwIe26NuAZazS7upywDBpGRmRNMW5-4h_JQKxOdB78nYVxZWnBXwCxOv7a3Sr_mCjiVzKsoQQZwL-CJzhYa0512tfYem56zls5a44y5QsdcfvuSzOvpthVhA9XkEfCJSqSY_sip5d8BelT_w_ikvd_8KqiQ_0H54RqYUN8svCpu28paHgBocHFNXTQ9NtU9ec2qgESXk7Jp4OTy9HJtQJavKDUqTJ3YmtLxUgsgBCe0FNMHUSEYC0Ys6PavYzdTwIzYCq84idmAxJOj-O_6eALJFH2sDTOQYHjzOae2t8eFmw6C-t55qjrCI91a9mUJEGPhYixiG4gR4PaEJ7wGvw"
+        "value": "jdweWJO8dmKw4feBggZGyiMcgTnxS6QycpTSKEZd9VV9munW+STSr45GimVdOXbBowArlrUDGUhrCa7Z1vv4HgwOPhKomDNSAgqt0t/TgPiIVWSN+cMcARj0Y8/hrZVzlu+IlWBv/MVyPoytASyH8eF1L3UQa4Xh8Ebpjvs9yAZsr9tWG2Q1sn4jKetRBJHz44IV4g2rTgut+rZHK9ubdNB91nzqoRuN162uQkKlC7tBuBASd53gOAeaxedTt1RuW7w56XzSx2k/60ehmBcNuLaYAds7g4e8qec1k+u6rc2scU4n+RHuZTvqXkwpEYUsAqKKn8G7wylSWjHszNUEUw"
       }
     }
   },

diff --git a/specification/keyvault/data-plane/Microsoft.KeyVault/stable/7.5/keys.json b/specification/keyvault/data-plane/Microsoft.KeyVault/stable/7.5/keys.json
@@ -1575,7 +1575,7 @@
           {
             "name": "RSA_OAEP",
             "value": "RSA-OAEP",
-            "description": "RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1."
+            "description": "[Not recommended] RSAES using Optimal Asymmetric Encryption Padding (OAEP), as described in https://tools.ietf.org/html/rfc3447, with the default parameters specified by RFC 3447 in Section A.2.1. Those default parameters are using a hash function of SHA-1 and a mask generation function of MGF1 with SHA-1. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_OAEP, which is included solely for backwards compatibility. RSA_OAEP utilizes SHA1, which has known collision problems."
           },
           {
             "name": "RSA_OAEP256",
@@ -1585,7 +1585,7 @@
           {
             "name": "RSA1_5",
             "value": "RSA1_5",
-            "description": "RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447."
+            "description": "[Not recommended] RSAES-PKCS1-V1_5 key encryption, as described in https://tools.ietf.org/html/rfc3447. Microsoft recommends using RSA_OAEP_256 or stronger algorithms for enhanced security. Microsoft does *not* recommend RSA_1_5, which is included solely for backwards compatibility. Cryptographic standards no longer consider RSA with the PKCS#1 v1.5 padding scheme secure for encryption."
           },
           {
             "name": "A128_GCM",