错误：0409A06E：rsa 例程数据对于密钥大小来说太大

Question

I'm generating a SAML response and it needs to be encrypted and signed with public and private keys. I generated private.pem and public.pem in the terminal with the commands

openssl genrsa -out private.pem 2048
openssl rsa -in ./private.pem -pubout -out public.pem

Then in nodeJS.

encrypt: function(message) {
    return new Promise(function (resolve, reject) {
        var publicKey = require("fs").readFileSync(__dirname + "/public.pem", "utf8");
        var encrypted = require("crypto").publicEncrypt(publicKey, new Buffer(message));
        resolve(encrypted.toString("base64"));
    });
},

Once I call the message encrypt(xml) , I get the following error

{
  library: 'rsa routines',
  function: 'RSA_padding_add_PKCS1_OAEP_mgf1',
  reason: 'data too large for key size',
  code: 'ERR_OSSL_RSA_DATA_TOO_LARGE_FOR_KEY_SIZE'
}

Objective :

I've to sign the message as per the demo here samltools.com ( Mode: SignMessage ), my SAML message looks like this . ( see SAML Response section ).

1. Sign the message
2. Base64Encode the message

Answer 1

The problem here is that you cannot directly encrypted with RSA , a piece of data which is larger than the key size.

Surprising I know, it surprised me too.

In reality very little payload data is encrypted directly with RSA or even elliptic curves.

You should be using RSA Diffie-Hellman to generate a shared secret.

Signature of the file, is really signature of the hash of the file.