Re: [CFRG] RSA PSS Salt Length for HTTP Message Signatures

[Neil Madden <[e-mail]>]

> On 28 May 2021, at 15:45, Justin Richer <[e-mail]> wrote:
> 
> On May 28, 2021, at 9:05 AM, Salz, Rich <[e-mail]> wrote:
>> 
>> Perhaps reconsider PSS.  https://www.metzdowd.com/pipermail/cryptography/2019-November/035449.html is excellent reading.
>> 
> 
> I appreciate the reference, thank you for that. It’s enlightening, but something to note: We aren’t :just: defining RSA-PSS, we’re also defining a flavor of RSA 1.5, a flavor of HMAC, and a flavor of ECDSA, each with fixed parameters including sizes and curves and the like.

No EdDSA? RSA signatures are not very performant for this kind of sign-once-verify-once use-case, because the signing operation is comparatively very expensive for short messages. Although that cost is pushed out to the client, which is preferable, if that client is sending a lot of small API requests this can be a very large overhead. 

I have some serious reservations about the use of signatures for this use case at all. There is no privacy considerations section in the draft, but surely making user’s HTTP requests signed has serious implications for their privacy? Especially if the signing key may be unique to an individual. I think this will have similar privacy issues as DKIM [1].

If the intent of the draft is to provide “end-to-end integrity and authenticity” then IMO a MAC is more appropriate than a signature (which provides much stronger properties), perhaps in combination with an authenticated KEM like HPKE [2].

[1]: https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ 

[2]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hpke#section-5.1.3

— Neil