Re: [Cfrg] Fwd: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm

[denis bider <[e-mail]>]

I have made another update to this draft which replaces the padding  method RSASSA-PKCS1-v1_5 with RSASSA-PSS.

Same URL:

http://www.denisbider.com/draft-rsa-dsa-sha2-256.txt

There  appear to be reasonable arguments (I've read Hanno Boeck's in particular) that PSS is safer to implement (no parsing trap to fall into) and  backed by stronger theory (provably secure under reasonable  assumptions). Support now seems to be sufficiently widespread, whereas  it wasn't earlier (support was added to OpenSSL in version 1.0.1 in  March 2012); so it now seems like a good opportunity to do this.

denis


denis bider <[e-mail]> , 10/31/2015 7:50 AM:
My understanding is it's common to feed the entropy of the message being signed into the RNG to prevent "k" reuse during e.g. VM state resumption.

Furthermore, RFC 6979 specifies how to implement deterministic DSA, which does not lose compatibility with unaware implementations.

I have updated the draft, which now additionally defines "rsa-sha2-256", which also requires a facelift:

http://www.denisbider.com/draft-rsa-dsa-sha2-256.txt

The Security Considerations section now references RFC 6979 and recommends deterministic signatures with DSA.

BTW - Hanno Boeck: Your messages are coming across in a way that requires an attachment to be opened in order to see message contents. I would not have opened the TXT attachment if it wasn't for Peter Gutmann's reply.

I believe this is due to the use of "Content-Type: multipart/signed", which is not recognized by all email software. 


----- Original Message -----
From: Damien Miller 
Sent: Friday, October 30, 2015 16:27
To: denis bider 
Cc: [e-mail] 
Subject: Re: [Cfrg] Fwd: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm

On Thu, 29 Oct 2015, denis bider wrote:

> Because variety is good. At Bitvise, our software supports ECDSA over NIST
> curves, and I'm going to implement EdDSA. However, if something turns out to
> be not-as-great-as-we-expected with elliptic crypto, RSA would be all we
> have left.
> 
> Everything in elliptic curve is too many eggs in one basket, I reckon.
> 
> What's wrong with large-key DSA?

It breaks in the most catastrophic possible way (private key leak) when a
less-than-perfect PRNG is used.

-d