fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets

[david-renaud-okta]

• Added checks to prevent invalid secrets from being used with the HS*** algorithms when signing and verifying
• Added checks to prevent the use of insecure asymmetric key sizes except when explicitly overriden via options

BREAKING CHANGE: Requires node 12.x or later to allow use of KeyObject

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This PR covers addresses 3 misconfigurations which could compromise security.

1. Signing with a public key that has a modulus length of less than 2048 is prevented by default. If required this check can be disabled by setting allowInsecureKeySizes to true in the options object.
2. It is no longer possible to use an RSA key to verify an HMAC signature
3. Prevented Buffers containing malicious objects from being used as key material.

Testing

New automated tests have been added for each scenario.

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[jakelacey2012]

Looks like we have missing coverage for node-16 and 18.

ERROR: Coverage for branches (94.72%) does not meet global threshold (95%)

However the changes in general look fine to me 👍 think we just need to find where that missing coverage is and add the tests.

[CharlesRea]

This is a slight change from previous behaviour: if we had a PEM with BEGIN RSA PUBLIC KEY, we knew we could narrow down to RSA only, otherwise for BEGIN PUBLIC KEY we allow all public algs.

The former case could have asymmetricKeyType === 'pub-rsa' so we end up allowing slightly more than before.

IMO let's pick up RSA-PSS here, and also handle ECC while we're here for consistency (technically a breaking change for EC though so we need to document it):

      if (secretOrPublicKey.type === 'secret') {
        options.algorithms = HS_ALGS;
      } else if (secretOrPublicKey.asymmetricKeyType === 'rsa-pss' || secretOrPublicKey.asymmetricKeyType === 'rsa-pss') {
        options.algorithms = RSA_KEY_ALGS;
      } if (secretOrPublicKey.asymmetricKeyType === 'ec') {
        options.algorithms = EC_KEY_ALGS;
      }
       else {
        options.algorithms = PUB_KEY_ALGS;
      }

[CharlesRea]

It'd be great to add some explanation of this in the README as well - we don't specify what happens if algorithms is undefined

[david-renaud-okta]

Done. We'll add the change to our migration guide