Re: [TLS] Case for negotiation of PKCS#1.5 RSASSA-PKCS1-v1_5 in TLS 1.3

[Hubert Kario <[e-mail]>]

On Monday 25 January 2016 10:29:18 Benjamin Kaduk wrote:
> On 01/22/2016 01:14 PM, Hubert Kario wrote:
> > On Friday 22 January 2016 10:39:26 Andrey Jivsov wrote:
> >> On 01/22/2016 03:14 AM, Hubert Kario wrote:
> >>>> The only solution that's available at this point is conditioning
> >>>> TLS
> >>>> 1.3 support on appropriate hardware. For this reason TLS 1.3 it
> >>>> probably won't be enabled by default in the product I work on. I
> >>>> would prefer for TLS 1.3 to be enabled by default and write the
> >>>> code
> >>>> to decide whether it does PSS or falls back to RSA PKCS1 1.5.
> >>> 
> >>> Yes, it would be nice. But PKCS#1 v1.5 had it long coming. Not
> >>> cutting it off now would be negligent.
> >> 
> >> You mean for HS only, while leaving it for X.509 certs?
> > 
> > If we don't do it for HS in TLS first, we'll never get rid of it in
> > X.509 certs.
> > 
> > We need to start somewhere, and it's more reasonable to expect that
> > hardware with support for new protocols will get updated for RSA-PSS
> > handling than that libraries and hardware will suddenly start
> > implementing it in droves just in anticipation of the time when CAs
> > _maybe_ will start issuing certificates signed with RSA-PSS.
> 
> Isn't it more a matter of TLS being a consumer of external PKIX
> infrastructure, the web PKI, etc.?  They are out of the reach of the
> IETF TLS working group; any requirements we attempted to impose would
> be unenforceable, even if there was an Internet Police (which there
> is not).

TLS will happily use PKCS#1 v1.5 signed X.509 certificates, so how 
exactly is creating a side effect of increasing the deployment rate of 
RSA-PSS _in TLS implementations_ an "overreach"?!
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic