Re: [Curdle] comments on draft-ietf-curdle-rsa-sha2-03.txt

[Ilari Liusvaara <[e-mail]>]

On Sun, Mar 26, 2017 at 10:50:02PM -0500, Daniel Migault wrote:
> Whether pss variant have to be added is up to the WG to decide. That I
> would be in favor is only one opinion ;-) [1] lists some advantages of PSS
> vs PKCS1v1.5. Note that enabling a given key may be used by two variants
> needs also some thoughts. I will raise the question during the meeting, but
> discussion will be made on the mailing list.

This thing came up in context of TLS 1.3.

The probability PKCS#1v1.5 and PSS signature overlaps depends on key
size and salt size. Where overlap is defined as encoded message that
is valid in both PKCS#1v1.5 and PSS. These depend on hashing algorithm
and number of bits in n, but not precise value of n.

TLS restricts salt length to be the same as hash length. Which makes
overlaps highly unlikely with key sizes >=2048 bits and hash sizes
<=512 bits. The problem being to control ~1000 bits using 512 bits.

As key size decreases or salt size increases, the overlap probability
increases, and eventually overlaps become almost certain, and further
one gets multiple overlaps.

> 
> [1]
> https://www.emc.com/emc-plus/rsa-labs/historical/raising-standard-rsa-signatures-rsa-pss.htm


-Ilari