Re: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

Dan Brown <danibrown@blackberry.com> Mon, 05 June 2017 14:03 UTC

From: Dan Brown <danibrown@blackberry.com>
To: Mike Jones <Michael.Jones@microsoft.com>, "cfrg@irtf.org" <cfrg@irtf.org>
CC: Steve KENT <steve.kent@raytheon.com>
Thread-Topic: Reference for hash substitution attack against RSASSA-PSS and its mitigation
Thread-Index: AdLb26Zx24x4lnXmRNe6X+ajH2VGUACJ9uGQ
Date: Mon, 05 Jun 2017 14:03:43 +0000
Message-ID: <810C31990B57ED40B2062BA10D43FBF501B1CFB4@XMB116CNC.rim.net>
References: <CY4PR21MB050485ED3B9A02F48EC2E81EF5F70@CY4PR21MB0504.namprd21.prod.outlook.com>
In-Reply-To: <CY4PR21MB050485ED3B9A02F48EC2E81EF5F70@CY4PR21MB0504.namprd21.prod.outlook.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_810C31990B57ED40B2062BA10D43FBF501B1CFB4XMB116CNCrimnet_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/JycdWrl4OlKAq29nXULe-UZjdiM>
Subject: Re: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation
Precedence: list

Just a guess: perhaps this old presentation by Kaliski:

http://grouper.ieee.org/groups/1363/Research/contributions/HashFunctionFirewalls.pdf

is relevant?

Probably even more off-topic: as I recall, the standardized version of PSS pre-hashes the message, whereas the original academic Bellare-Rogaway version does not.  The difference between the standard and the academic version is a little like the difference between Schnorr and DSA-style signatures.  So, for standard PSS, the hash must resist collisions, pre-images, etc., whereas for the original PSS, perhaps much less is needed from hash (the proof assumes a super-strong hash, of course).  I suppose that this in turn may be a concern for hash substitutions ...

From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Mike Jones
Sent: Friday, June 2, 2017 4:06 PM
To: cfrg@irtf.org
Cc: Steve KENT <steve.kent@raytheon.com>
Subject: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

Is there a paper that describes the theoretical hash substitution attacks against RSASSA-PSS and how they are mitigated?

                                                                Thanks,
                                                                -- Mike

[Cfrg] Reference for hash substitution attack aga… Mike Jones
Re: [Cfrg] Reference for hash substitution attack… Paterson, Kenny
Re: [Cfrg] Reference for hash substitution attack… Mike Jones
Re: [Cfrg] Reference for hash substitution attack… Dan Brown