Re: [TLS] PSS for TLS 1.3

[Eric Rescorla <[e-mail]>]

On Sun, Mar 22, 2015 at 6:53 PM, Brian Smith <[e-mail]> wrote:

> Eric Rescorla <[e-mail]> wrote:
> > Obviously, if we want to move to PSS, option #2 is simplest, but
> > the sentiment at the interim was to survey the WG to see whether
> > there was widespread enough support for generating and verifying
> > PSS to make this feasible [0].
>
> PSS with which parameters?
>

I would be fine with mandating a minimum of SHA-256.

-Ekr


> My suggestion is that, if PSS is used, (SHA-256, MGF-SHA-256, 32-byte
> salt) should be used with the SHA-256-based PRF and that (SHA-384,
> MGF-SHA-384, 48-byte salt) should be used with the SHA-384-based PRFs.
>
> [1] notes that there is a security advantage to using the same digest
> function for the MGF as was used for digesting the signed data. It
> would be a mistake to mandate support for MGF-SHA-1 in PSS signatures
> in TLS 1.3, because a TLS 1.3 implementation shouldn't be need to
> implement SHA-1 at all.
>
> Some implementations are hard-coded to support only MGF-SHA-1 and 20
> byte salts. It is better to require those implementations to be
> updated than to require all implementations to implement SHA-1 just
> for the MGF.
>
> Cheers,
> Brian
>
> [1] https://tools.ietf.org/html/rfc3447#section-8.1
>