Re: [CFRG] RSA PSS Salt Length for HTTP Message Signatures

[Peter Gutmann <[e-mail]>]

Justin Richer <[e-mail]> writes:

>I had been using one library that defaults this to 20, another library
>defaults it to (I think?) 32, and another library seems to vary it based on
>the SHA hash size. Is there a best practice here, or a way to determine what
>the correct salt length is? I couldn’t find anything in RFC8017 that suggests
>an appropriate value, so if I’m just missing it please point me to it.

In theory the spec suggests using the hash size, but as you've found in
practice everyone seems to do whatever they feel like, and it's not just for
the salt size, since PSS leaves almost everything as a user-choice parameter
you'll find all sorts of weird unexpected stuff there, with endless weird
corner cases that you'd think no-one would ever implement until you find
something that does.  One thing to look out for is the leading-bits-trimming
that's required but very well disguised in the spec, since some
implementations do it and some don't.

A more general comment is that it'd make more sense to specify PKCS #1 with
encode-then-memcmp() rather than forcing people to guess how other
implementations of PSS work, it's just a huge implementation headache that'll
be repeated for everyone who has to do it.

Peter.