Re: [TLS] Using RSA PSS in TLS

[Johannes Merkle <[e-mail]>]

> RSA-PSS would apply only to the DHE_RSA variants, for the vanilla
> RSA ciphersuites, one would need RSA-OAEP instead, and it seems
> that using a traditional RSA key/cert for both, signature and
> encryption is somewhat incompatible with RSA-PSS/RSA-OAEP -- when
> signaling is through the AlgorithmIdentifier in SPKI of the
> entity certificate.

As I wrote to Santosh, the PSS AlgorithmIdentifier in SPKI is only optional and hardly supported. TLS-Servers should get
a certificate with the usual rsaPublicKey AlgorithmIdentifier in SPKI, which can be used for any RSA operation,
including PSS, OAEP and even signature and encryption according to PKCS#1v1.5.

> 
> Having to support two seperate server certificate (different by algorithm)
> would have a huge impact on
>    - TLS implementations
>    - administrative UIs
>    - server administration procedures
>    - CA procedures
> 
> What exactly is the real and serious problem that such a HUGE change
> would be trying to fix?
> 

No huge change implied by the change.

I admit there is no big issue with old RSA, it it just anticipation of potential future attacks by using a provably
secure algorithm.


-- 
Johannes