Re: [Cfrg] pkcs#1v1.5

[Johannes Merkle <[e-mail]>]

6 months ago, I raised the question on the tls mailing list, if we shouldn't allow usage of RSA-PSS signatures in TLS.
There was almost no support for that idea and the arguments I faced were
 - The need to support both legacy RSA and RSA-PSS introduces considerable complexity, in particular, if we try to reuse
existing cipher suites
 - PSS doesn't give much benefit over PKCS#1v1.5. As Peter Gutmann put it: "I know
it's *theoretically* better, but unless you do -1.5 really badly there's no
practical weakness that would encourage an upgrade."

I was told that there was an attempt, some years ago, to mandate RSA-PSS for certificates.  It was met with pretty much
universal rejection, to the extent that people would probably ignore the requirement even if it was made a MUST in the
spec and as a result was dropped.

Clearly the issue with PKCS#1v1.5 encryption is worse, so there might be more urge to migrate to OAEP. As development of
TLS 1.3 is just about to start, this might be the right time.

Johannes


Russ Housley schrieb am 23.03.2014 22:12:
> {top post}
> 
> Last December, on two separate SAAG mail list threads, I suggested that we begin the migration to RSA-OAEP and RSA-PSS.  I have copied the first message in each of those threads below to save folks time with the mail archive search.  I continue to believe that we should begin this migration.
> 
> It takes a really long time to make such a transition.  Let's get started today.
> 
> Russ
> 
> = = = = = = = = =
> 
> From: Russ Housley <[e-mail]>
> Date: December 4, 2013 5:40:33 AM EST
> To: IETF SAAG <[e-mail]>
> Subject: [saag] RSA-OAEP
> 
> We have known for a very long time that PKCS #1 Version 1.5 (see RFC 2313) key transport is vulnerable to adaptive chosen ciphertext attacks.  Exploitation reveals the result of a particular RSA decryption, requires access to an oracle which will respond to a hundreds of thousands of ciphertexts, which are constructed adaptively in response to previously-received replies providing information on the successes or failures of attempted decryption operations.  As a result, the attack appears significantly less feasible in store-and-forward environments than interactive ones.
> 
> PKCS #1 Version 2.0 and Version 2.1 (see RFC 3447) include RSA-OAEP to address this situation, but we have seen very little movement toward RSA-OAEP.  While we are reviewing algorithm choices in light of the pervasive surveillance situation, I think we should take the time to address known vulnerabilities like this one.  If we don't, then we are leaving an partially open door for a well funded attacker.
> 
> Russ
>