Re: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12

["Mark D. Baushke" <[e-mail]>]

Salz, Rich <[e-mail]> writes:

> Eric rightly pounts out that this is a tech change made during the
> final stage of RFC editing and that it should be confirmed by the WG.
> It's about MAY accepting fewer leading zero's.
> 
> Does anyone object?
> 
>     > > The value for 'rsa_signature_blob' is encoded as a string that
>     > > contains an octet string S (which is the output of RSASSA-PKCS1-v1_5)
>     > > and that has the same length (in octets) as the RSA modulus.  When S
>     > > contains leading zeros, there exist signers that will send a shorter
>     > > encoding of S that omits them.  A verifier MAY accept shorter
>     > > encodings of S with one or more leading zeros omitted.

Question:

If the octet string S begins with the most significant bit set, is it a
MUST or a SHOULD or a MAY to prepend a zero octet so that the number is
not considered to be negative?

Consideration:

RFC 8017 section 4.1 specifies x as a nonnegative integer to be
converted to an Octet String primitive. It is not clear if the octet
string S is to always be considered unsigned or not.

RFC4251 provides that an mpint is a multiple precision integer in two's
complement format, stored as a string, 8 bits per byte, MSB first.
Negative numbers have the value 1 as the most significant bit of the
first byte of the data partition. If the most significant bit would be
set for a positive number, the number MUST be preceded by a zero byte
[RFC4251, sectio 5, page 8.]. RFC4251 provides that a 'string'

If draft-ietf-curdle-rsa-sha2-12 would like to see the
rsa_signature_blob be treated as an mpint with a leading zero-byte for
strings that otherwise would look negative, why not just change the type
in section 3 to read:

The resulting signature is encoded as follows:

    string    "rsa-sha2-256" / "rsa-sha2-512"
    mpint      rsa_signature_blob

  The value for 'rsa_signature_blob' is encoded as a string containing
  S   - an octet string which is the output of RSASSA-PKCS1-v1_5, of
  length equal to the length in octets of the RSA modulus. As with any
  mpint, there may be a leading zero octet to ensure that S is considered
  a nonnegative number.

If I have misunderstood the rationale for the change, please let me
know.

	Thank you,
	-- Mark