{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/479","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/479/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/479/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/479/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/479","id":141843248,"number":479,"title":"Discussion - OpenSSL padding","user":{"login":"juliangut","id":1104131,"avatar_url":"https://avatars.githubusercontent.com/u/1104131?v=3","gravatar_id":"","url":"https://api.github.com/users/juliangut","html_url":"https://github.com/juliangut","followers_url":"https://api.github.com/users/juliangut/followers","following_url":"https://api.github.com/users/juliangut/following{/other_user}","gists_url":"https://api.github.com/users/juliangut/gists{/gist_id}","starred_url":"https://api.github.com/users/juliangut/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juliangut/subscriptions","organizations_url":"https://api.github.com/users/juliangut/orgs","repos_url":"https://api.github.com/users/juliangut/repos","events_url":"https://api.github.com/users/juliangut/events{/privacy}","received_events_url":"https://api.github.com/users/juliangut/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/thephpleague/oauth2-server/labels/Discussion","name":"Discussion","color":"207de5"},{"url":"https://api.github.com/repos/thephpleague/oauth2-server/labels/V5","name":"V5","color":"009800"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-18T11:40:02Z","updated_at":"2016-04-09T14:52:34Z","closed_at":"2016-04-09T14:52:34Z","body":"Organizing the ideas around OpenSSL padding\r\n\r\nAs per @paragonie-scott comment if no padding is specified in https://github.com/thephpleague/oauth2-server/blob/V5-WIP/src/CryptTrait.php#L74 we end up in this problem [ZF2015-10](http://framework.zend.com/security/advisory/ZF2015-10)\r\n\r\nAs per PHP documentation openssl_private_encrypt and openssl_public_decrypt don't accept `OPENSSL_PKCS1_OAEP_PADDING` as padding parameter\r\n\r\nOn the other hand openssl_public_encrypt and openssl_private_decrypt do accept `OPENSSL_PKCS1_OAEP_PADDING` padding\r\n\r\nHaving a look at how zendframework/zend-crypt handles this `OPENSSL_PKCS1_OAEP_PADDING` is used for [public encryption](https://github.com/zendframework/zend-crypt/blob/master/src/PublicKey/Rsa/PublicKey.php#L82) and [private decryption](https://github.com/zendframework/zend-crypt/blob/master/src/PublicKey/Rsa/PrivateKey.php#L118) while `OPENSSL_PKCS1_PADDING` is used on the other way around\r\n\r\nAs per @alexbilbie comment:\r\n\r\n> My thinking is that the authorization server signs things with it's private key.\r\n>\r\n> The resource server and anything else that needs to validate access tokens can use the public key to verify the integrity of the token.\r\n\r\nBut according to previously shown information `OPENSSL_PKCS1_OAEP_PADDING` can't be used to encrypt with private key\r\n\r\nThe other way of seing token encryption is that the server encrypts tokens with its public key so only the server can read them back (authorization and resource servers should share same keys). This is my thinking\r\n\r\nWhat is the case of someone else checking token integrity? (really asking)"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/207800323","html_url":"https://github.com/thephpleague/oauth2-server/issues/479#issuecomment-207800323","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/479","id":207800323,"user":{"login":"alexbilbie","id":77991,"avatar_url":"https://avatars.githubusercontent.com/u/77991?v=3","gravatar_id":"","url":"https://api.github.com/users/alexbilbie","html_url":"https://github.com/alexbilbie","followers_url":"https://api.github.com/users/alexbilbie/followers","following_url":"https://api.github.com/users/alexbilbie/following{/other_user}","gists_url":"https://api.github.com/users/alexbilbie/gists{/gist_id}","starred_url":"https://api.github.com/users/alexbilbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexbilbie/subscriptions","organizations_url":"https://api.github.com/users/alexbilbie/orgs","repos_url":"https://api.github.com/users/alexbilbie/repos","events_url":"https://api.github.com/users/alexbilbie/events{/privacy}","received_events_url":"https://api.github.com/users/alexbilbie/received_events","type":"User","site_admin":false},"created_at":"2016-04-09T14:52:34Z","updated_at":"2016-04-09T14:52:34Z","body":"I'm closing this for now because I don't believe this is an issue with how the library has implemented encryption (i.e. use private key to encrypt, public key to verify)"}}