Re: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12

[Peter Gutmann <[e-mail]>]

denis bider <[e-mail]> writes:

>The problem with this phrasing is that it doesn't say:
>
>encode "S" as specified in RSASSA-PKCS1-v1_5
>
>It instead says:
>
>[...]
>
>- "a string containing s (which is an integer, without lengths or padding,
>unsigned, and in network byte order)"

By saying "without lengths or padding" it seems to be saying that you
shouldn't zero-pad.  Or at least that's how I interpreted it.

>Because of this ambiguity, the spec for "rsa-sha2-256" and "rsa-sha2-512" -
>which is the subject of present discussion - comes out and says explicitly:
>though shalt encode "S". Which is fixed-length.

Given that this has been ambiguous for untold years, it might be a good idea
to mention that you shouldn't expect to find this fixed-length zero-padded
encoding but may get a form, uh "without lengths or padding".  I don't care
either way since my code will handle both forms, but there are I-don't-know-
how-many different SSH implementations out there where we can't easily tell
what they do.

>It has been like that since the first version if the draft, in November 2015,
>which you reviewed. :)

Well, yeah, but that text says different things to different people :-).

Peter.