IETF Logo Mail Archive

Re: [TLS] TLS 1.3 draft-07 sneak peek

Hanno Böck <hanno@hboeck.de> Sun, 05 July 2015 18:18 UTC

Return-Path: <hanno@hboeck.de>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C54F1A907F for <tls@ietfa.amsl.com>; Sun, 5 Jul 2015 11:18:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 2.699
X-Spam-Level: **
X-Spam-Status: No, score=2.699 tagged_above=-999 required=5 tests=[BAYES_50=0.8, MANGLED_BACK=2.3, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wJ92Gowr3rsy for <tls@ietfa.amsl.com>; Sun, 5 Jul 2015 11:18:40 -0700 (PDT)
Received: from zucker2.schokokeks.org (zucker2.schokokeks.org [178.63.68.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3886F1A907A for <tls@ietf.org>; Sun, 5 Jul 2015 11:18:40 -0700 (PDT)
Received: from pc1 (x4d0c3270.dyn.telefonica.de [::ffff:77.12.50.112]) (AUTH: LOGIN hanno-default@schokokeks.org, TLS: TLSv1/SSLv3, 128bits, ECDHE-RSA-AES128-GCM-SHA256) by zucker.schokokeks.org with ESMTPSA; Sun, 05 Jul 2015 20:18:37 +0200 id 0000000000000072.00000000559974FD.000037D7
Date: Sun, 05 Jul 2015 20:19:44 +0200
From: Hanno Böck <hanno@hboeck.de>
To: mrex@sap.com
Message-ID: <20150705201944.5dfce8d5@pc1>
In-Reply-To: <20150703235427.C674B1A1B3@ld9781.wdf.sap.corp>
References: <20150702164536.598b0430@pc1> <20150703235427.C674B1A1B3@ld9781.wdf.sap.corp>
X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.28; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=_zucker.schokokeks.org-14295-1436120317-0001-2"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/UnybCp_ydKG3CEZznWXDPMKgY3I>
Cc: tls@ietf.org
Subject: Re: [TLS] TLS 1.3 draft-07 sneak peek
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 05 Jul 2015 18:18:42 -0000

On Sat, 4 Jul 2015 01:54:27 +0200 (CEST)
mrex@sap.com (Martin Rex) wrote:

> Hanno Böck wrote:
> > On RSA there was only limited discussion, but I had the impression
> > there is hardly an argument for not going with PSS
> 
> You seem to believe that RSA-PSS is better than PKCS#1 v1.5 signature
> padding.  Could you elaborate why you believe this to be?

The most obvious reason is the Bleichenbacher signature forgery attack
and related issues like BERserk. I can hardly think how anything
similar could happen with PSS.
BERserk especially highlights a new problem of the old PKCS: Having a
complex encoding (ASN.1) directly inside a cryptographic function seems
like a bad idea.
I know that it is possible to implement PKCS #1 1.5 without these
issues. But the past has shown that these mistakes happen.

There's also the theoretic argument (it has a "security proof" with a
certain definition of proof), but imho the practical implications - PSS
is harder to get wrong - are more relevant.

> It was my impression that RSA-PSS adds complexity and slows down
> things

The added complexity is limited. The performance probably is hardly
measurable. It's a couple of added hash calculations. But if this is a
real concern I can try to create some benchmarks.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: BBB51E42

v2.23.0 | Report a Bug | By Email