Re: [jose] RSASSA-PSS signature

[John Bradley <[e-mail]>]

I have already updated the slides and sent them on to Jim and Karen to include the issue.

The question is given the recent feedback on interoperability, is if IDESG will allow us through with no MTI.

MTI is not mandatory to use as a WG chair once mentioned.   

Is there really a objection to having libraries include the ability to do RSA-PKCS1-v1.5 encryption as a base?

I agree applications determine the algorithms used. 

John B.

On 2013-03-12, at 4:29 PM, Mike Jones <[e-mail]> wrote:

> I obviously defer to the working group on whether it’s a bug or not.  I was just trying to have us be clear on what the specs actually say and why.
>  
> We should probably try to get a clear decision on whether to change that tomorrow.  Maybe John should incorporate a slide on it into his presentation, since he’s already covering all the other open issues?
>  
>                                                             Cheers,
>                                                             -- Mike
>  
> From: Richard Barnes [mailto:[e-mail]] 
> Sent: Tuesday, March 12, 2013 1:24 PM
> To: Mike Jones
> Cc: John Bradley; Peck, Michael A; [e-mail]
> Subject: Re: [jose] RSASSA-PSS signature
>  
> Yes, I know the current JWA says that.  That's a bug.  I just submitted an issue.  We have discussed this several times in the working group, most recently in Atlanta, where there was a fair degree of agreement on removing requirements levels.
>  
> --Richard
>  
>  
>  
> On Tue, Mar 12, 2013 at 4:11 PM, Mike Jones <[e-mail]> wrote:
> Your statement that there are no MTI algorithms is actually incorrect.  The current JWA draft specifies REQUIRED (and RECOMMENED and OPTIONAL) algorithms, and indeed, as currently chartered, we are required to define the set of MTI algorithms.
>  
> The spreadsheet characterizing platform support for possible algorithms that John referred to is attached.  As you can see, RSA PKCS1-v1_5 is the only ubiquitously implemented asymmetric encryption algorithm.
>  
>                                                             -- Mike
>  
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Richard Barnes
> Sent: Tuesday, March 12, 2013 12:49 PM
> To: John Bradley
> Cc: Peck, Michael A; [e-mail]
> Subject: Re: [jose] RSASSA-PSS signature
>  
> Since we are not putting requirements on algorithms (i.e., there is no MTI), there's no harm to having PSS in the algorithms list.  Only benefit!  
> --Richard
>  
>  
> On Tue, Mar 12, 2013 at 3:24 PM, John Bradley <[e-mail]> wrote:
> This has had a fair amount of discussion.   While I think almost everyone would prefer PSS, many implementations are going to be in scripting languages where the underlying libraries only support PKCS1-v1_5.
>  
> We did a survey of platforms to evaluate if we could move to PSS and the result lead us not to make PSS as the MTI.  In think that was reported out at the Atlanta IETF meeting.
> Nat may be able to forward that to you, I don't have it handy.
>  
> If we were talking about starting from scratch and not building on existing platforms likely the answer would have been different.
>  
> The algorithms are extensible so PSS can be added.   The other consideration is that many of the people who care will be using ECESA signatures anyway.
>  
> John B.
>  
> On 2013-03-12, at 2:52 PM, "Peck, Michael A" <[e-mail]> wrote:
>  
> draft-ietf-jose-json-web-algorithms-08 includes RSASSA-PKCS1-v1_5 signatures but not RSASSA-PSS.
>  
> The Security Considerations states:
>    While Section 8 of RFC 3447 [RFC3447] explicitly calls for people not
>    to adopt RSASSA-PKCS1 for new applications and instead requests that
>    people transition to RSASSA-PSS, this specification does include
>    RSASSA-PKCS1, for interoperability reasons, because it commonly
>    implemented.
>  
> Shouldn’t RSASSA-PSS at least be included as an option?
> I’m also not sure if I fully understand the interoperability concerns.  JWS is a new specification, so it makes sense to me to use whatever algorithms are currently considered best practice, without need to worry about backwards compatibility?
>  
> Mike
>  
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose
>  
> 
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose
> 
>