[Cfrg] Hash substitution in PSS

["Igoe, Kevin M." <[e-mail]>]

On 4 August Jim Schaad pointed out that the choice of hash algorithm in PSS is not authenticated and asked if this was a security problem.

The good news is that if all of the hash algorithms in use are "secure", the only risk is the "birthday problem", and the aVailability of more than one hash does not a priori result in a cheaper attack.

The bad news is that if one of the hashes is broken, so broken that an adversary has a non-trivial chance of finding an "evil" message that has the same hash value as a benign message formed with a hash that is "secure", they can substitute the evil message under the weak hash for the benign message under the strong hash. Preventing this requires either that (1) the have a policy to reject all messages with the weak hash or (2) the choice of hash algorithm be authenticated. Personally I trust a cryptographic authentication over policy.