Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

I have to admit that I was thinking about using a Full Domain Hash for the
signature, esp. because you could probably XOR in the ASN.1 hash algorithm
identifier and get back the hash substitution attack.   However when I look
at http://web.cs.ucdavis.edu/~rogaway/papers/exact.pdf I see that they claim
that PSS is more secure that Full Domain.  I have not done any sort of
search to see if things are tighter now than they were back in '96.

Jim

From: Cfrg <cfrg-bounces@irtf.org> On Behalf Of Saqib A. Kakvi
Sent: Wednesday, September 19, 2018 8:58 AM
To: cfrg@irtf.org
Subject: Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

Hello Russ,

Replacing MGF1 with SHAKE should not present any problems that I can see.
The Mask Generation Function was used to overcome the fact that hash
functions have fixed length outputs. The fact that SHAKE is an eXtensible
Output Function (XOF) means that one no longer needs to use an MGF.

On the other hand, since we do have an XOFs, I'm not sure that RSA-PSS
should still be the algorithm of choice, but rather one might consider
switching to the simpler RSA-Full Domain Hash or PKCS#1 v1.5 signature
schemes.
Tibor Jager, Alexander May and myself have recently found a security proof
for PKCS#1 v1.5 signatures, with the caveats that one must double their
modulus length and use an XOF/MGF. I will be presenting this result will at
CCS 18 next month, and would be glad to discuss it with anybody there.
Additionally version should be appear in the IACR ePrint archive in the near
future. I am also happy to send a copy of the paper to anybody who would
like to have one.

Best
Saqib

From: Russ Housley <housley@vigilsec.com <mailto:housley@vigilsec.com> >

Subject: [Cfrg] A new MGF for RSA-PSS based on SHAKE

Date: 17 September 2018 at 22:57:10 CEST

To: IRTF CFRG <cfrg@irtf.org <mailto:cfrg@irtf.org> >

Dear CFRG:

The IETF LAMPS WG is specifying the use of SHAKE with RSA-PSS for use with
certificates and CMS signed objects.  The current drafts are:

              draft-ietf-lamps-cms-shakes-01.txt
              draft-ietf-lamps-pkix-shake-02.txt

In discussion of these drafts, it was suggested that instead of replacing
SHA-1 in the RSA-PSS default mask generation function (MGF), one could
replace the entire MGF with SHAKE.  While it does look like a simple
substitution, I do not think the IETF LAMPS WG is the right group to make
the assessment.  CFRG may have people with the right skills, so I would
greatly appreciate you thoughts on this idea.

Russ

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org <mailto:Cfrg@irtf.org> 
https://www.irtf.org/mailman/listinfo/cfrg