Environment details

• OS: not relevant for the issue
• Python version: not relevant for the issue
• pip version: not relevant for the issue
• google-auth version: 1.23.0, currently latest

Steps to reproduce

Security vulnerability scanners pick up an unfixed PKCS#1 decryption code issue with the rsa library 4.6 (see among the dependencies in setup.py in this project): sybrenstuvel/python-rsa#165 => although it is closed, from the comments it seems that it is not fixed, and anyway new version for this library is not released for some time...

One of the proposed solutions would be: sybrenstuvel/python-rsa#165 (comment) :
"3. modify code you depend on so that it uses libraries that do provide side-channel free behaviour for RSA decryption"

Questions:

1. Could you please confirm that this google-auth library does not use the vulnerable PKCS#1 decrypt() method, so that this rsa library issue can be considered a false-positive for google-auth? I tried to check quickly, for me this seems to be the case.
2. Would it be needed / feasible for google-auth to use another crypto library which does not have this issue? Is there a crypto library which would have clear advantages over the python rsa library?