Re: [TLS] Using RSA PSS in TLS

On 14/10/13 12:08, Santosh Chokhani wrote:
> Since ECDHE_RSA or DHE_RSA says that the Server public key is RSA, the SPKI in the Server certificate would indicate it is RSA 1.5 or PSS and you do not need additional cipher suites.

But, when the server is deciding which of its 1 or more certs to send, 
how can it tell whether or not the client supports PSS?

> -----Original Message-----
> From: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] On Behalf Of Peter Gutmann
> Sent: Monday, October 14, 2013 6:59 AM
> To: <tls@ietf.org>
> Subject: Re: [TLS] Using RSA PSS in TLS
>
> =?UTF-8?B?SGFubm8gQsO2Y2s=?= <hanno@hboeck.de> writes:
>
>> legacy compatibility is exactly the point. Implementations must be
>> prepared to communicate to servers / clients that do not support the new version.
>
> Never underestimate that amount of weight that carries.  There was an attempt, some years ago, to mandate RSA-PSS for certificates.  It met with pretty much universal rejection, to the extent that people would probably ignore the requirement even if it was made a MUST in the spec (at the time it was described as "X9.42 all over again", a reference to another MUST that everyone ignored), and as a result was dropped.
>
> The problem with -PSS is that it doesn't real fix anything in -1.5 (I know it's *theoretically* better, but unless you do -1.5 really badly there's no practical weakness that would encourage an upgrade).  Counting against that is the near-insurmountable cost of a changeover (everyone has to redeploy global crypto infrastructure from scratch).
>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online