Re: [TLS] PR to clarify RSASSA-PSS requirements

[Ilari Liusvaara <[e-mail]>]

On Wed, Nov 22, 2017 at 09:42:04AM +0100, Nikos Mavrogiannopoulos wrote:
> On Wed, 2017-11-22 at 03:54 +0000, Peter Wu wrote:
> > Hi,
> > 
> > At the moment there is still ambiguity in the requirements for PSS
> > with
> > relation to certificates. Proposal to clarify this:
> > https://github.com/tlswg/tls13-spec/pull/1098
> > 
> > 
> > This PR intends to clarify the requirements for PSS support.
> 
> Hi,
>  I commented on the PR, but to provide more context. I believe RSA-PSS
> keys without parameters MUST be supported under TLS1.3. The reason is
> that keys explicitly marked as RSA-PSS cannot be used for RSA PKCS#1
> 1.5 encryption, and thus they provide a way for the server to know that
> it must protect that key against (cross-protocol) attacks which utilize
> RSA ciphersuites under TLS1.2.

Furthermore, this would also let the client know that the key itself is
not likely to be subject to DROWN-type issues.

This becomes extremely significant when considering things like
Delegated Credentials (WG document now). E.g., I consider it
unacceptable risk to accept DCs signed with RsaEncryption keys.
_Even_ if the certificate has an additional extension.

> On why you don't want mixing keys for TLS1.3 and TLS1.2 RSA
> ciphersuites, see all the bleichenbacher attack reiterations over the
> years.

There was a rather nasty one just very recently.

> So what about distinguishing the RSA-PSS keys with and without
> parameters:
> 
> "an RSASSA-PSS public key (OID id-RSASSA-PSS) without parameters MUST
> be supported, while an RSASSA-PSS public key (OID id-RSASSA-PSS) with
> parameters MAY be supported`."

+1


-Ilari