Re: [TLS] PSS for TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Sun, 2015-03-22 at 15:09 -0700, Eric Rescorla wrote:
> During the interim we discussed discussion about adopting PSS for
> RSA signatures in TLS 1.3.
> Clearly, we will not be able to just adopt PSS because certificates
> will continue to be signed with PKCS#1 1.5. However, we could adopt
> PSS for signatures outside of the certificate context. Roughly
> speaking, we have three options:
> 1. Do not adopt PSS.
> 2. Adopt PSS as the only signature format for non-certificate
>    signatures (but require acceptance of PKCS#1 1.5 for
>    certificates)
> 3. Negotiate the use of PSS versus PKCS#1 1.5

Does (3) imply the usage of signatureAlgorithms to negotiate? I guess
that's the more natural approach, as a client could support both RSA and
PSS_RSA at the same time.

However, that is complicated by the fact that new ciphersuites are
needed to use RSA_PSS on the end certificates. That's because the
ciphersuite name contains the type of the certificate of the peer.
I have argued about abolishing that [0].

Overall, I'm not sure how useful is a connection with PSS signature in
the handshake, but with a PKCS #1 1.5 signature in the certificate.
However, that looks like the only path to deprecate PKCS #1 1.5 and move
to PSS (if the WG thinks it's worth it).

regards,
Nikos

[0]. https://github.com/tlswg/tls13-spec/issues/98