Re: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12

[denis bider <[e-mail]>]

I agree with either MAY or SHOULD.

I suggested MAY on the following grounds:

1. I was speculating it could help this new text, which I knew was too
late, be accepted more easily. This hasn't panned out, but that seems for
the best. :)

2. Years in the future, there may be a time when deployed implementations
all encode "S" correctly. At that point, we may no longer want to SHOULD a
special case that's no longer relevant.

3. It weakens the claim of implementations that don't send the zeros that
they follow the spec. They can more easily make this claim if there is a
"SHOULD" to accommodate them.


However, I also see the following arguments for SHOULD:

4. It's unavoidable current practice, so it may convey the more accurate
idea to a new implementer.

5. Quantum computing will likely make RSA irrelevant much before all
implementations encode "S" correctly.


All things considered, I prefer MAY, and the main reason is 3 - not letting
implementations who don't send the zeros to claim that they're doing it
right. I'm also okay with SHOULD, but it enables the implementations that
created the problem to begin with. :)



On Sun, Mar 11, 2018 at 11:43 PM, Mark D. Baushke <[e-mail]> wrote:

> Hi denis,
>
> My question is answered.
>
> Rich asked:
>
> > Does anyone object?
> >
> >     > > The value for 'rsa_signature_blob' is encoded as a string that
> >     > > contains an octet string S (which is the output of
> RSASSA-PKCS1-v1_5)
> >     > > and that has the same length (in octets) as the RSA modulus.
> When S
> >     > > contains leading zeros, there exist signers that will send a
> shorter
> >     > > encoding of S that omits them.  A verifier MAY accept shorter
> >     > > encodings of S with one or more leading zeros omitted.
>
> I do not object.
>
> Given at approximately 1/256 signatures will have a naturally occurring
> leading zero for which some implementations do not send it and some do,
> I have no objection with the change in text.
>
> I do wonder if the text would better read:
>
>  A verifier SHOULD accept shorter encodings of S with one or more
>  leading zeros omitted.
>
> to encourage a stronger likelyhood that a valid, but short signature
> would still be accepted. However, I will leave that to others to
> determine.
>
>         -- Mark
>