Re: [TLS] PSS for TLS 1.3

[Ilari Liusvaara <[e-mail]>]

On Mon, Mar 23, 2015 at 07:42:26PM +0000, Paterson, Kenny wrote:
> >
> >We want to accomodate the uptake of ECC, so ...
> >
> >If RSA keys, then sign handshake with RSA-PSS.
> >If ECC keys, then sign handshake with ECDSA.
> 
> Just a quick heads-up with my CFRG hat on. We should soon be making a
> start over there on defining signature schemes for use with the curves
> that we have now selected; our DH deliberations are nearing completion.
> 
> One quick question for this group: how important is it to you to have
> ECDSA - or something very close to it (e.g. a derandomised version) - for
> TLS use, and how much appetite is there for adopting schemes that deviate
> more significantly from ECDSA (e.g. EdDSA)?

My personal view (I have also looked at what this would take):
Not important, I would very much like a modern signature system (esp.
inversion-free[1]).

But I would want:
- Both curves usable in the same signature framework.
- Only use common hash function propeties for both curves[2], especially
  for verification interop[3].


Assignments required:
- TLS signaturealgorithm codepoint
- TLS namedcurve codepoints
- OIDs for the signature curves
- OIDs for PKIX (Signature,Hash) algorithm pair.

All can be done with RFC & expert review.


[1] Inversions are not only highly annoying to implement safe way,
but are also pretty slow.

[2] Good test: Does this work with standard-issue SHA-512?

[3] This is for the case if anything happens to the primary algorithm.


-Ilari