Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

Hello Jim,

PSS was more secure than FDH in 1996, but that has since changed. 
Jean-Sebastian Coron showed an optimal proof (with proof of optimality) 
in 2001 (ia.cr/2001/062<https://ia.cr/2001/062>) and in 2012, Eike Kiltz 
and myself showed that one can get a better proof for FDH for small 
exponents. 
(http://www5.rz.rub.de:8032/mam/foc/content/publ/rsa-fdh_fullversion.pdf) 
In this case FDH is as secure as PSS.

Best,
Saqib

On 19/09/2018 19:53, Jim Schaad wrote:
>
> I have to admit that I was thinking about using a Full Domain Hash for 
> the signature, esp. because you could probably XOR in the ASN.1 hash 
> algorithm identifier and get back the hash substitution attack.   
> However when I look at 
> http://web.cs.ucdavis.edu/~rogaway/papers/exact.pdf 
> <http://web.cs.ucdavis.edu/%7Erogaway/papers/exact.pdf> I see that 
> they claim that PSS is more secure that Full Domain.  I have not done 
> any sort of search to see if things are tighter now than they were 
> back in ’96.
>
> Jim
>
> *From:*Cfrg <cfrg-bounces@irtf.org> *On Behalf Of *Saqib A. Kakvi
> *Sent:* Wednesday, September 19, 2018 8:58 AM
> *To:* cfrg@irtf.org
> *Subject:* Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE
>
> Hello Russ,
>
> Replacing MGF1 with SHAKE should not present any problems that I can 
> see. The Mask Generation Function was used to overcome the fact that 
> hash functions have fixed length outputs. The fact that SHAKE is an 
> eXtensible Output Function (XOF) means that one no longer needs to use 
> an MGF.
>
> On the other hand, since we do have an XOFs, I'm not sure that RSA-PSS 
> should still be the algorithm of choice, but rather one might consider 
> switching to the simpler RSA-Full Domain Hash or PKCS#1 v1.5 signature 
> schemes.
> Tibor Jager, Alexander May and myself have recently found a security 
> proof for PKCS#1 v1.5 signatures, with the caveats that one must 
> double their modulus length and use an XOF/MGF. I will be presenting 
> this result will at CCS 18 next month, and would be glad to discuss it 
> with anybody there. Additionally version should be appear in the IACR 
> ePrint archive in the near future. I am also happy to send a copy of 
> the paper to anybody who would like to have one.
>
> Best
> Saqib
>
>
>
>     *From: *Russ Housley <housley@vigilsec.com
>     <mailto:housley@vigilsec.com>>
>
>     *Subject: [Cfrg] A new MGF for RSA-PSS based on SHAKE*
>
>     *Date: *17 September 2018 at 22:57:10 CEST
>
>     *To: *IRTF CFRG <cfrg@irtf.org <mailto:cfrg@irtf.org>>
>
>     Dear CFRG:
>
>     The IETF LAMPS WG is specifying the use of SHAKE with RSA-PSS for
>     use with certificates and CMS signed objects.  The current drafts are:
>
>     draft-ietf-lamps-cms-shakes-01.txt
>     draft-ietf-lamps-pkix-shake-02.txt
>
>     In discussion of these drafts, it was suggested that instead of
>     replacing SHA-1 in the RSA-PSS default mask generation function
>     (MGF), one could replace the entire MGF with SHAKE.  While it does
>     look like a simple substitution, I do not think the IETF LAMPS WG
>     is the right group to make the assessment.  CFRG may have people
>     with the right skills, so I would greatly appreciate you thoughts
>     on this idea.
>
>     Russ
>
>     _______________________________________________
>     Cfrg mailing list
>     Cfrg@irtf.org <mailto:Cfrg@irtf.org>
>     https://www.irtf.org/mailman/listinfo/cfrg
>