Re: [Spasm] New Version Notification for draft-wconner-blake2sigs-00.txt

[Brian Smith <[e-mail]>]

Ryan Sleevi <[e-mail]> wrote:
> > Jim Schaad <[e-mail]> wrote:
>>
>> I think that that is a regrettable but understandable opinion for an
>> existing signature algorithm.  I find it less convincing for a new signature
>> algorithm.
>
> Why is that?
>
> Many HSMs can handle this as well - using CKM_RSA_PKCS, in which the caller
> provides the encoded digest algorithm OID and hash, and the HSM performs the
> overall encapsulation. This was very much at the forefront of CAs concerns.
> It also simplifies implementations with many existing cryptographic
> libraries.

According to the draft itself, the motivation for the draft is to have
a backup in case of a failure of a cryptographic algorithm,
specifically one or more of the SHA-2 algorithms. It seems likely that
the PKCS#1 signature scheme will fail before any of the SHA-2
algorithms fail.

Accordingly, I agree with Jim. Extending PKCS#1 with any new digest
algorithms is a bad idea. Let's get rid of PKCS#1. Instead, it would
be better to specify a deterministic full-domain-hash signature scheme
instead of PKCS#1, alongside RSA-PSS.

FWIW, some PKCS#11 modules also implement the RAW RSA mechanisms,
which allow RSA-PSS and other (in particular, deterministic
full-domain hash) algorithms to be implemented. There's really not
much advantage to a HSM implementing CKM_RSA_PKCS for arbitrary digest
algorithms, but not implementing the RAW RSA primitive.

Note also that some modules may implement CKM_RSA_PKCS, but whitelist
the digest algorithms that are supported for use with it.

Cheers,
Brian
-- 
https://briansmith.org/