Re: [TLS] Using RSA PSS in TLS

[[e-mail] (Martin Rex)]

Hanno Böck wrote:

[ Charset UTF-8 unsupported, converting... ]
> On Wed, 14 Jan 2015 15:32:42 +0100
> CodesInChaos <[e-mail]> wrote:
> 
> > I consider the risk of PKCS#1v1.5 encryption far bigger than the risk
> > of PKCS#1v1.5 signatures.
> > I'm not aware of any attack against  PKCS#1v1.5 signatures, they
> > merely lack a security proof.
> 
> Bleichenbacher's signature forgery attack [1], which has recently been
> re-discovered in combination with some ASN.1 issues under the name
> BERserk [2].
> 
> Sure, these are "mere implementation issues". You can do PKCS #1 1.5
> signatures right - just like you can do PKCS #1 1.5 encryption right.
> It's just that people did it wrong multiple times. I don't see simliar
> risks with PSS, it's the much more robust solution.

The problem really is the original bogus approach how to _verify_
PKCS#1 v1.5 signatures.
If the spec was tightened to prohibit *all* kinds of parsing
of the RSA-decrypted BT01 padding signature plaintext,
and instead required rebuilding of the BT01 padding from the input hash
value and input hash oid, and comparison of the newly composed result
with what the RSA decryption returned, then none of the parser problems
for RSA PKCS#1 v1.5 signatures would have existed.

That approach to RSA signature verification is actually the one
recommended by PKCS#1 v2.1 for the RSASSA-PKCS1-V1_5-VERIFY operation.

  https://tools.ietf.org/html/rfc3447#section-8.2.2

And given its age (rfc3447 was published in February 2003),
the more robust verification _could_ have been required for
TLSv1.1 (2006) and TLSv1.2 (2008), but such improvements seem
to have been rotting in the same forgotten drawer as Serge Vaudenay's
proposed fix to the CBC mac-pad-encrypt weakness...


-Martin