Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: myinfo encryptedAndSignedPersona to use enc A256GCM #684

Merged
merged 1 commit into from
Sep 12, 2024

Conversation

lwinxp
Copy link

@lwinxp lwinxp commented Sep 11, 2024

Problem

  1. In myinfo docs (Developers_FAQ.pdf), noted use of A256GCM
image
  1. Q15 of https://api.singpass.gov.sg/library/myinfo/developers/FAQ

  2. current product integration with myinfo test api is also using A256GCM and it is working

Solution

  1. Update A128CBC-HS256 to A256GCM

@cflee
Copy link
Contributor

cflee commented Sep 11, 2024

I double-checked the TUO v3.2.6 spec that I have on hand (in case it differs from v4 as linked above) and it does say A256GCM as well. Looks like it was left like this in #563 for backwards compatibility reasons, but I think there's a case to be made that this is a bugfix (instead of a breaking change) as any client strictly enforcing A128CBC-HS256 instead of A256GCM is doing it wrong anyway.

@lwinxp lwinxp changed the title Update myinfo encryptedAndSignedPersona to use enc A256GCM fix: myinfo encryptedAndSignedPersona to use enc A256GCM Sep 12, 2024
@lwinxp
Copy link
Author

lwinxp commented Sep 12, 2024

thanks for the review and finding more info on this

the pr title and commit message have been changed to fix

@LoneRifle LoneRifle merged commit 707250c into opengovsg:main Sep 12, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants