Re: [TLS] Using RSA PSS in TLS

[[e-mail] (Martin Rex)]

Peter Gutmann wrote:
> <[e-mail]> writes:
> 
>>Appparently [1] NSS and BoringSSL has been doing that for a few months now
>>(though NSS seems to take steps to allow some variation), maybe they could
>>provide some feedback?
>>
>>[1]: https://www.imperialviolet.org/2014/09/26/pkcs1.html
> 
> I've been doing this for ages, and I believe OpenSSL does as well(?).  Never
> had any problems (or at least none reported) so far...

Btw. TLSv1.2 explicitly requires support for a slight variation
(NULL and absent parameters) on the TLSv1.2 RSA PKCS#1 v1.5
digitally-signed signature verification, see rfc5246,
section 4.7 3rd paragraph:

  https://tools.ietf.org/html/rfc5246#section-4.7

   In RSA signing, the opaque vector contains the signature generated
   using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1].  As
   discussed in [PKCS1], the DigestInfo MUST be DER-encoded [X680]
   [X690].  For hash algorithms without parameters (which includes
   SHA-1), the DigestInfo.AlgorithmIdentifier.parameters field MUST be
   NULL, but implementations MUST accept both without parameters and
   with NULL parameters.  Note that earlier versions of TLS used a
   different RSA signature scheme that did not include a DigestInfo
   encoding.


-Martin