Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

However, there are two practical issues with what the paper actually proves:

- It proves that PKCS v1.5 signature with a 2n bit modulus is (at least as) hard to break as n bit RSA.  Hence, to get (say) 128  bit security, we would need (say) RSA-6144, rather than the conventional wisdom of RSA-3072.

- Even that that, the proof doesn't apply to v1.5 as used in practice, as it requires quite long hash outputs

To quote the paper:

Concretely, for signatures instantiated with an 2048-bit RSA modulus N, we can prove security under the 1024-bit RSA assumption, with 1024-bit padding and 1024-bit hash function....  Thus, ... our proofs do not immediately apply to PKCS#1 v1.5 when instantiated with standard hash functions, such as SHA-512...

Yes, v1.5 is nicer in practice, and it's good to have a proof of something, but lets not oversell what we have. 

> -----Original Message-----
> From: Cfrg <cfrg-bounces@irtf.org> On Behalf Of Peter Gutmann
> Sent: Wednesday, September 26, 2018 3:14 PM
> To: John Mattsson <john.mattsson@ericsson.com>; Saqib A. Kakvi
> <saqib.kakvi@uni-paderborn.de>; cfrg@irtf.org
> Subject: Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE
> 
> John Mattsson <john.mattsson@ericsson.com> writes:
> 
> >If FDH gives better security it should be discussed, but based on your
> >comments it is only as secure as PSS.
> 
> Also, given recent results, neither are more secure than good old v1.5:
> 
> https://eprint.iacr.org/2018/855
> 
> Given that PSS and FDH are much, much more complex to implement than
> v1.5 (i.e. more things to go wrong), and require a source of random numbers
> that
> v1.5 doesn't, is there any advantage to using PSS or FDH over just staying
> with v1.5?
> 
> Peter.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg