Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

[John Mattsson <[e-mail]>]

>What I suggested was that we just switch to a new MGF function where we computed
>        SHAKE ( mfgSeed, maskLen)

That looks like a good idea.

From: Jim Schaad <[e-mail]>
Date: Wednesday, 26 September 2018 at 16:55
To: John Mattsson <[e-mail]>, "'Saqib A. Kakvi'" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: RE: [Cfrg] A new MGF for RSA-PSS based on SHAKE

The current proposal in the draft is to replace SHA-1 in MGF1 with SHAKE where the SHAKE output size is essentially infinite so that there is never a need to iterate on the counter.  This means that you compute
      SHAKE(  mfgSeed || I2OSP(counter = 0, 4) , maskLen)

What I suggested was that we just switch to a new MGF function where we computed
        SHAKE ( mfgSeed, maskLen)

Jim


From: Cfrg <[e-mail]> On Behalf Of John Mattsson
Sent: Tuesday, September 25, 2018 11:41 PM
To: Saqib A. Kakvi <[e-mail]>; [e-mail]
Subject: Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE

Hi,

I think an important aspect here is what we actually believe people will implement. Given that there is an ongoing (but slow) move to ECDSA/EdDSA and people are expecting to start implementing the outcome of the NIST PQC standardization in 5 years, I do not know how interested people are to implement something new based on RSA.

If FDH gives better security it should be discussed, but based on your comments it is only as secure as PSS. I feel like making small and easy to implement changes to RSA-PSS is the way to go.

Is the use of SHA-1 in RSA-PSS causing any known security problems, or is the idea to remove SHA-1 anyway (which makes sense)?

Cheers,
John

From: Cfrg <[e-mail]<mailto:[e-mail]>> on behalf of "Saqib A. Kakvi" <[e-mail]<mailto:[e-mail]>>
Date: Wednesday, 19 September 2018 at 20:32
To: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE


Hello Jim,

PSS was more secure than FDH in 1996, but that has since changed. Jean-Sebastian Coron showed an optimal proof (with proof of optimality) in 2001 (ia.cr/2001/062) and in 2012, Eike Kiltz and myself showed that one can get a better proof for FDH for small exponents. (http://www5.rz.rub.de:8032/mam/foc/content/publ/rsa-fdh_fullversion.pdf) In this case FDH is as secure as PSS.

Best,
Saqib

On 19/09/2018 19:53, Jim Schaad wrote:
I have to admit that I was thinking about using a Full Domain Hash for the signature, esp. because you could probably XOR in the ASN.1 hash algorithm identifier and get back the hash substitution attack.   However when I look at http://web.cs.ucdavis.edu/~rogaway/papers/exact.pdf<http://web.cs.ucdavis.edu/%7Erogaway/papers/exact.pdf> I see that they claim that PSS is more secure that Full Domain.  I have not done any sort of search to see if things are tighter now than they were back in ’96.

Jim


From: Cfrg <[e-mail]><mailto:[e-mail]> On Behalf Of Saqib A. Kakvi
Sent: Wednesday, September 19, 2018 8:58 AM
To: [e-mail]<mailto:[e-mail]>
Subject: Re: [Cfrg] A new MGF for RSA-PSS based on SHAKE


Hello Russ,

Replacing MGF1 with SHAKE should not present any problems that I can see. The Mask Generation Function was used to overcome the fact that hash functions have fixed length outputs. The fact that SHAKE is an eXtensible Output Function (XOF) means that one no longer needs to use an MGF.

On the other hand, since we do have an XOFs, I'm not sure that RSA-PSS should still be the algorithm of choice, but rather one might consider switching to the simpler RSA-Full Domain Hash or PKCS#1 v1.5 signature schemes.
Tibor Jager, Alexander May and myself have recently found a security proof for PKCS#1 v1.5 signatures, with the caveats that one must double their modulus length and use an XOF/MGF. I will be presenting this result will at CCS 18 next month, and would be glad to discuss it with anybody there. Additionally version should be appear in the IACR ePrint archive in the near future. I am also happy to send a copy of the paper to anybody who would like to have one.

Best
Saqib




From: Russ Housley <[e-mail]<mailto:[e-mail]>>
Subject: [Cfrg] A new MGF for RSA-PSS based on SHAKE
Date: 17 September 2018 at 22:57:10 CEST
To: IRTF CFRG <[e-mail]<mailto:[e-mail]>>

Dear CFRG:

The IETF LAMPS WG is specifying the use of SHAKE with RSA-PSS for use with certificates and CMS signed objects.  The current drafts are:

              draft-ietf-lamps-cms-shakes-01.txt
              draft-ietf-lamps-pkix-shake-02.txt

In discussion of these drafts, it was suggested that instead of replacing SHA-1 in the RSA-PSS default mask generation function (MGF), one could replace the entire MGF with SHAKE.  While it does look like a simple substitution, I do not think the IETF LAMPS WG is the right group to make the assessment.  CFRG may have people with the right skills, so I would greatly appreciate you thoughts on this idea.

Russ

_______________________________________________
Cfrg mailing list
[e-mail]<mailto:[e-mail]>
https://www.irtf.org/mailman/listinfo/cfrg