Re: [TLS] Using RSA PSS in TLS

Better solution would be to use RSA-KEM (see basic description in RFC
5990) instead of PKCS#1v1.5 encryption.

The RSA-KEM is secure in the random oracle model (modelling the KDF as a
random oracle), with very good security guarantees:

Johan Hastad and Mats Naslund. The security of all RSA and discrete log
bits.
http://www.nada.kth.se/~johanh/hnrsaacm.pdf

Victor Shoup. A Proposal for an ISO Standard for Public Key Encryption.
https://eprint.iacr.org/2001/112.pdf

On 14.01.2015 15:32, CodesInChaos wrote:
> On Wed, Jan 14, 2015 at 3:15 PM, Florian Weimer <fweimer@redhat.com> wrote:
>> What about changing PFS for the RSA ciphersuites so that they continue to
>> use RSA encryption, and not rely on an RSA signature for server
>> authentication?
> 
> Switching from PKCS#1v1.5 encryption to OAEP is just as tricky as
> switching from PKCS#1v1.5 signing to PSS signatures.
> 
> I consider the risk of PKCS#1v1.5 encryption far bigger than the risk
> of PKCS#1v1.5 signatures.
> I'm not aware of any attack against  PKCS#1v1.5 signatures, they
> merely lack a security proof.
> PKCS#1v1.5 encryption is problematic since detectable decryption
> failures can act as an oracle. Implementations need to be really
> careful to avoid these.
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 