Re: [Curdle] comments on draft-ietf-curdle-rsa-sha2-03.txt

[denis bider <[e-mail]>]

That is a welcome assurance. If PSS is added, it sounds like something to
mention in Security Considerations as a further argument against small keys.

On Mon, Mar 27, 2017 at 1:24 AM, Ilari Liusvaara <[e-mail]>
wrote:

> On Sun, Mar 26, 2017 at 10:50:02PM -0500, Daniel Migault wrote:
> > Whether pss variant have to be added is up to the WG to decide. That I
> > would be in favor is only one opinion ;-) [1] lists some advantages of
> PSS
> > vs PKCS1v1.5. Note that enabling a given key may be used by two variants
> > needs also some thoughts. I will raise the question during the meeting,
> but
> > discussion will be made on the mailing list.
>
> This thing came up in context of TLS 1.3.
>
> The probability PKCS#1v1.5 and PSS signature overlaps depends on key
> size and salt size. Where overlap is defined as encoded message that
> is valid in both PKCS#1v1.5 and PSS. These depend on hashing algorithm
> and number of bits in n, but not precise value of n.
>
> TLS restricts salt length to be the same as hash length. Which makes
> overlaps highly unlikely with key sizes >=2048 bits and hash sizes
> <=512 bits. The problem being to control ~1000 bits using 512 bits.
>
> As key size decreases or salt size increases, the overlap probability
> increases, and eventually overlaps become almost certain, and further
> one gets multiple overlaps.
>
> >
> > [1]
> > https://www.emc.com/emc-plus/rsa-labs/historical/raising-
> standard-rsa-signatures-rsa-pss.htm
>
>
> -Ilari
>