Re: [jose] RSASSA-PSS signature

Yes, I know the current JWA says that.  That's a bug.  I just submitted an
issue.  We have discussed this several times in the working group, most
recently in Atlanta, where there was a fair degree of agreement on removing
requirements levels.

--Richard

On Tue, Mar 12, 2013 at 4:11 PM, Mike Jones <Michael.Jones@microsoft.com>wrote:

>  Your statement that there are no MTI algorithms is actually incorrect.
> The current JWA draft specifies REQUIRED (and RECOMMENED and OPTIONAL)
> algorithms, and indeed, as currently chartered, we are required to define
> the set of MTI algorithms.****
>
> ** **
>
> The spreadsheet characterizing platform support for possible algorithms
> that John referred to is attached.  As you can see, RSA PKCS1-v1_5 is the
> only ubiquitously implemented asymmetric encryption algorithm.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] *On Behalf
> Of *Richard Barnes
> *Sent:* Tuesday, March 12, 2013 12:49 PM
> *To:* John Bradley
> *Cc:* Peck, Michael A; jose@ietf.org
> *Subject:* Re: [jose] RSASSA-PSS signature****
>
> ** **
>
> Since we are not putting requirements on algorithms (i.e., there is no
> MTI), there's no harm to having PSS in the algorithms list.  Only benefit!
> ****
>
> --Richard****
>
> ** **
>
> ** **
>
> On Tue, Mar 12, 2013 at 3:24 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:**
> **
>
> This has had a fair amount of discussion.   While I think almost everyone
> would prefer PSS, many implementations are going to be in scripting
> languages where the underlying libraries only support PKCS1-v1_5.****
>
> ** **
>
> We did a survey of platforms to evaluate if we could move to PSS and the
> result lead us not to make PSS as the MTI.  In think that was reported out
> at the Atlanta IETF meeting.****
>
> Nat may be able to forward that to you, I don't have it handy.****
>
> ** **
>
> If we were talking about starting from scratch and not building on
> existing platforms likely the answer would have been different.****
>
> ** **
>
> The algorithms are extensible so PSS can be added.   The other
> consideration is that many of the people who care will be using ECESA
> signatures anyway.****
>
> ** **
>
> John B.****
>
> ** **
>
> On 2013-03-12, at 2:52 PM, "Peck, Michael A" <mpeck@mitre.org> wrote:****
>
> ** **
>
>    draft-ietf-jose-json-web-algorithms-08 includes RSASSA-PKCS1-v1_5
> signatures but not RSASSA-PSS.****
>
>  ****
>
> The Security Considerations states:****
>
>    While Section 8 of RFC 3447 [RFC3447] explicitly calls for people not**
> **
>
>    to adopt RSASSA-PKCS1 for new applications and instead requests that***
> *
>
>    people transition to RSASSA-PSS, this specification does include****
>
>    RSASSA-PKCS1, for interoperability reasons, because it commonly****
>
>    implemented.****
>
>  ****
>
> Shouldn’t RSASSA-PSS at least be included as an option?****
>
> I’m also not sure if I fully understand the interoperability concerns.
> JWS is a new specification, so it makes sense to me to use whatever
> algorithms are currently considered best practice, without need to worry
> about backwards compatibility?****
>
>  ****
>
> Mike****
>
>  ****
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose****
>
>  ** **
>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>