Re: [dnsext] RSA algorithm padding in RFC 5702, RSASSA-PSS

[Paul Wouters <[e-mail]>]

On Wed, 20 Oct 2010, Hanno Böck wrote:

> I'm currently working on a study project about RSASSA-PSS. This is a padding
> variant with security proofs and standardized within PKCS #1 2.1.
>
> I saw that dnssec currently seems to use the old PKCS #1 1.5 padding methods
> (RFC 5702, Section 3). I wonder if there was any discussion about that
> decision (there is some hint in section 8.1). RFC 5702 was published in 2009,
> so it's a pretty new standard.
>
> Are there any plans to support algorithms with EMSA-PSS-padding within dnssec
> in the future?

I brought this up a year or two ago, when RSASHA256 was getting
specified.  Specifically, I argued the IETF itself had already
recommended moving from PKCS 1.1.5 to RSASSA-PSS in 2003:
http://tools.ietf.org/html/rfc3447#section-8.2

At the time the concensus seemed to be that RSASSA-PSS was less
standarised and less available in crypto libraries, and the gains on
theoretical security would be lost in practical implementation issues
(interop issues, implementation mistakes, etc)

I can't find the thread but I think it was on the dnssec-deployment or dnsext list.

Paul