Re: [TLS] Using RSA PSS in TLS

[[e-mail] (Martin Rex)]

Johannes Merkle wrote:
>
> While the current discussion on this list is about ECC,
> I would like to raise the question if it were not desirable to
> allow usage of provably secure RSA-PSS signatures from PKCS#1v2.1 in TLS.
> 
> Of course, an issue with this idea is that, if we replace DHE_RSA and
> ECDHE_RSA with DHE_PSS and ECDHE_PSS, we end up
> with a whole bunch of new cipher suites. An alternative could be a
> new extension signaling the RSA version used (with
> PKCS#1v1.5 as default).
> 
> Any thoughts on that?

RSA-PSS would apply only to the DHE_RSA variants, for the vanilla
RSA ciphersuites, one would need RSA-OAEP instead, and it seems
that using a traditional RSA key/cert for both, signature and
encryption is somewhat incompatible with RSA-PSS/RSA-OAEP -- when
signaling is through the AlgorithmIdentifier in SPKI of the
entity certificate.

Having to support two seperate server certificate (different by algorithm)
would have a huge impact on
   - TLS implementations
   - administrative UIs
   - server administration procedures
   - CA procedures

What exactly is the real and serious problem that such a HUGE change
would be trying to fix?


-Martin