encrypt use pkcs1v5

[sy2339226]

Within your project, RSA encryption with PKCS#1 v1.5 padding is employed at particular points, which I've identified. The use of RSA-PKCS1v5 can expose your system to several types of oracle attacks. An oracle attack occurs when an attacker can obtain information about the decryption of a ciphertext by observing the behavior of the encryption or decryption process, often through repeated queries to a decryption oracle. Such attacks can potentially lead to the disclosure of sensitive information or the forging of signatures, compromising the confidentiality and integrity of your data.

To mitigate these security vulnerabilities, it is strongly advised to transition from RSA-PKCS1v5 to RSA-PSS (Probabilistic Signature Scheme) for public key encryption tasks. RSA-PSS is a more secure alternative that incorporates randomness into the padding scheme, making it significantly more resistant to oracle attacks. Its design ensures stronger protection against adversaries trying to break the encryption or forge signatures, thus providing enhanced security for your cryptographic operations.

By implementing RSA-PSS instead of RSA-PKCS1v5, you can bolster your system's defenses against sophisticated attacks and maintain higher levels of data security and privacy. This change is particularly critical in environments where the integrity and confidentiality of information are paramount.

		"SourceCode": "return rsa.EncryptPKCS1v15(RandReader, pubKey, plaintext)",
		"SourceFilename": "github.com/crewjam/saml/xmlenc/pubkey.go",
		"SourceLineNum": 151,

in addtion, the cost default parameter for bcrypt has been updated to 12 in PHP, and 10 has been the default parameter for over 10 years. We suggest updating this parameter to obtain better security protection

		"SourceCode": "user.HashedPassword, err = bcrypt.GenerateFromPassword([]byte(*user.PlaintextPassword), bcrypt.DefaultCost)",
		"SourceFilename": "github.com/crewjam/saml/samlidp/user.go",
		"SourceLineNum": 79,

		"SourceCode": "hashedPassword, _ := bcrypt.GenerateFromPassword([]byte(\"hunter2\"), bcrypt.DefaultCost)",
		"SourceFilename": "github.com/crewjam/saml/example/idp/idp.go",
		"SourceLineNum": 95,