IETF Logo Mail Archive

Re: [TLS] TLS 1.3: Deterministic RSA-PSS and ECDSA

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 09 August 2016 08:55 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E8A512D54F for <tls@ietfa.amsl.com>; Tue, 9 Aug 2016 01:55:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.447
X-Spam-Level:
X-Spam-Status: No, score=-5.447 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.247] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id APhWSf3g41YN for <tls@ietfa.amsl.com>; Tue, 9 Aug 2016 01:55:39 -0700 (PDT)
Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6FB012D53D for <tls@ietf.org>; Tue, 9 Aug 2016 01:55:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1470732939; x=1502268939; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=EnpaDKHurbWh3ZRawCaLlRqOgsP8IkBuWYjWaJMt0rA=; b=SS8dg+WGXJk13Ccg2PiYUyzgHe9p2aQosl/Gdf/rqlwVwOcdNM+dzRoV e0m9eZXyF3uFoBCc3r1Yr6xOy0jP1FXgx2w8HWuLDboiguU4ht2cqh4U6 YIkWUUCXYSXR0Pj61nhPS0F/WhAuiv/1EnrRaCoyWMuupcXjrfR6J8FIG OAfiZLzp/FX5TbvsNAN1jsL0NICTtpUvktcu06XOohtSmJVEtil7LbAPF zF6IP8OhuBH7AFRdilMvFwrz5ckC/7N/NEI+1BCe88wCCYXJbsZ6NCVyA avj6LTRC5RUcCxxDJySq0QGVETmfm4f3TocKdiqmLCJ89tsk3GkNXSKRk g==;
X-IronPort-AV: E=Sophos;i="5.28,494,1464609600"; d="scan'208";a="101629948"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 130.216.4.106 - Outgoing - Outgoing
Received: from uxchange10-fe2.uoa.auckland.ac.nz ([130.216.4.106]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 09 Aug 2016 20:55:31 +1200
Received: from UXCN10-5.UoA.auckland.ac.nz ([169.254.5.93]) by uxchange10-fe2.UoA.auckland.ac.nz ([130.216.4.106]) with mapi id 14.03.0266.001; Tue, 9 Aug 2016 20:55:31 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Tony Arcieri <bascule@gmail.com>, "mrex@sap.com" <mrex@sap.com>
Thread-Topic: [TLS] TLS 1.3: Deterministic RSA-PSS and ECDSA
Thread-Index: AQHR8Gfj7F33ORxaEkOd+LaMKFmFkqA8R+IAgAH2WQCAAHybgIABm9Tz
Date: Tue, 09 Aug 2016 08:55:30 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4CE4907@uxcn10-5.UoA.auckland.ac.nz>
References: <20160806235716.726a0e4e@pc1> <20160808125514.C83D71A51C@ld9781.wdf.sap.corp>, <CAHOTMVJXTbbQKc4f7oc8nabrUqbY9QjEumvyUJn16uD4UdeLuw@mail.gmail.com>
In-Reply-To: <CAHOTMVJXTbbQKc4f7oc8nabrUqbY9QjEumvyUJn16uD4UdeLuw@mail.gmail.com>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.6.3.4]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/ZFWcO6-2PiwXRjt7LJBPoqlPH0M>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLS 1.3: Deterministic RSA-PSS and ECDSA
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Aug 2016 08:55:42 -0000

Tony Arcieri <bascule@gmail.com> writes:

>Do you think we'll see real-world MitM attacks against RSA-PSS in TLS similar
>to those we've seen with PKCS#1v1.5 signature forgery, such as BERserk?

Not BERserk specifically because that was an attack on the ASN.1, not the
signature format.  OTOH PSS doesn't encode the hash algorithm as 1.5 does, so
here's a much simpler attack: Take a breakable hash function with an output
the same size as the one used in the sig, generate your collision, and paste
the sig onto colliding data, indicating the use of the breakable function not
the one used to generate the original sig.  Done.  Couldn't happen with 1.5
because that encodes the details of the hash function used as part of the
signature.

Peter.

v2.23.0 | Report a Bug | By Email