Re: [TLS] Using RSA PSS in TLS

Oops.  My bad.  I mixed up signature algorithms with SPKI.

-----Original Message-----
From: Santosh Chokhani 
Sent: Monday, October 14, 2013 7:09 AM
To: <tls@ietf.org>
Subject: RE: [TLS] Using RSA PSS in TLS

Since ECDHE_RSA or DHE_RSA says that the Server public key is RSA, the SPKI in the Server certificate would indicate it is RSA 1.5 or PSS and you do not need additional cipher suites.

-----Original Message-----
From: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] On Behalf Of Peter Gutmann
Sent: Monday, October 14, 2013 6:59 AM
To: <tls@ietf.org>
Subject: Re: [TLS] Using RSA PSS in TLS

=?UTF-8?B?SGFubm8gQsO2Y2s=?= <hanno@hboeck.de> writes:

>legacy compatibility is exactly the point. Implementations must be 
>prepared to communicate to servers / clients that do not support the new version.

Never underestimate that amount of weight that carries.  There was an attempt, some years ago, to mandate RSA-PSS for certificates.  It met with pretty much universal rejection, to the extent that people would probably ignore the requirement even if it was made a MUST in the spec (at the time it was described as "X9.42 all over again", a reference to another MUST that everyone ignored), and as a result was dropped.

The problem with -PSS is that it doesn't real fix anything in -1.5 (I know it's *theoretically* better, but unless you do -1.5 really badly there's no practical weakness that would encourage an upgrade).  Counting against that is the near-insurmountable cost of a changeover (everyone has to redeploy global crypto infrastructure from scratch).

Peter.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls