Re: [TLS] PSS for TLS 1.3

[Hanno Böck <[e-mail]>]

I'm glad this comes up. I wanted to push for it again, but didn't find
the time lately.

On Sun, 22 Mar 2015 15:09:31 -0700
Eric Rescorla <[e-mail]> wrote:

> 2. Adopt PSS as the only signature format for non-certificate
>    signatures (but require acceptance of PKCS#1 1.5 for
>    certificates)

+1

I think this totally makes sense. I think we should see Signatures for
PKI separately that for TLS (i.e. signing certificates versus signing
handshakes). Pushing PKI to support PSS can be done separately, but it
is probably much more difficult due to backwards compatibility issues.
But it doesn't need to happen inside the TLS 1.3 specification.
(and the tech / spec for doing so is already available)

I have some ideas how this should be done though. The PSS spec
currently allows a wide range of flexibility. It is for example in
theory possible to use two different hash functions within the same
signature (there's a hash and an mgf that's based on a hash). I think it
would make implementations much easier if the spec defined a
pre-defined set of sane parameters and doesn't allow the full
flexibility of PSS. Also - which seems obvious - the use of insecure
parameters (sha1, I'm looking at you) should be forbidden completely.


(and if this helps: I wrote my diploma thesis on pss a few years ago
and the nss implementation was originally written by me. I think I have
a pretty good idea about the issues surrounding PSS, if anyone feels
they have any questions I'm glad to try to answer them.)

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [e-mail]
GPG: BBB51E42